Threat actors use GSocket to keep access after Linux web flaws are fixed
Defender detections rose 356.2% from March to August 2026, and patching the original web flaw does not remove the client.
Stories per day · 30 days
1 RSS
Relatedcommand-and-control1ecommerce1javascript-loader1linux1magento1persistence1polyshell1skimmer1web-applications1
3 stories, newest first · one card per story
Stories tagged #gsocket
deepveindrilling.com Magento loader found on 83 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware
Feral Wolf exploited Atlassian Confluence and 1C:Enterprise flaws to deploy GenieLocker ransomware across Russian retail, construction, manufacturing and IT firms.
3