GSocket abuse: Linux web servers — threat actors deploy open-source relay tool for stealthy persistent C2 after RCE patching

Severity: high · Patch status: no-fix-needed · Since 2026-11-11

Microsoft reports multiple unrelated threat actors deploying GSocket, an open-source remote access tool, on compromised Linux web servers to maintain persistent access after the original web application RCE vulnerabilities were patched. GSocket relays traffic through the public Global Socket Relay Network, so both the host and operator connect outbound and there is no attacker-owned IP or domain to block; the deployment script supports process renaming, memory-backed staging, and reboot-surviving persistence. Defender telemetry from March–August 2026 shows GSocket detections up 356.2%, concentrated on web applications and hosting (87.1%), especially PHP/cPanel (63.9%) and Apache (24.3%); education/research (30.7%) and technology/telecom (22.9%) sectors most affected, likely due to exposure. Remediation requires hunting for GSocket deployment, persistence, and outbound relay connections, not just patching the initial vulnerability.

What to do

Hunt for GSocket artifacts: gs-netcat/gs-linux binaries, renamed processes, files in memory-backed directories (tmpfs/run), cron/systemd persistence on Linux web servers
Review outbound connections to Global Socket Relay Network infrastructure and apply egress filtering to the relay endpoints
Do not treat application patching alone as complete remediation; assume persistence if a web RCE was exploited and audit for privilege escalation and added persistence
Patch internet-facing PHP applications and Apache services; inventory decentralized web estates, especially in academic environments
Monitor Defender/SIEM for GSocket-related detections and investigate affected hosts for post-compromise activity

Sources

The global socket: how threat actors are weaponizing GSocket for stealthy C2 (microsoft.com)

All live incidents on Threat Watch

Threat Watch– active

All incidents

More on Threat Watch

More Microsoft incidents

eMudhra/emSign CA key compromise — 8 more intermediate CAs revoked after buggy Python key-transfer script High · Breach
Microsoft Exchange Server: Turla's Cereal backdoor silently copies selected government email High · Breach
Microsoft Outlook: NTLM hash-leak zero-day exploited in Nov 2026 Patch Tuesday (CVE-2026-124194) High · Patch now
Windows 10 KB5131096 ESU: November 2026 security fixes, plus PowerShell and NTLM signing changes High · Patch now
@ethersphere/bee-js 13.3.0: malicious npm release steals Swarm wallet files and plants persistence Critical · Supply chain
2026-11-chromacli campaign: chromacli / supercolor-tui / rainbowcolors (PyPI) — typosquatted color libs drop Solace infostealer on Windows Critical · Supply chain

Browse

Helix Cyber

Is your stack exposed? Get it tested.

The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.

Get a pentest How it works

Agent Virtualization

Enterprise Coding Agents

Private AI Platform

Digital Sovereignty

Follow the Sun

The Speed Advantage

Financial Services

GPU Cloud & Neoclouds

Public Sector & Defence

More on Threat Watch

More Microsoft incidents

Browse

Is your stack exposed? Get it tested.