The global socket: how threat actors are weaponizing GSocket for stealthy C2
Microsoft has observed multiple incidents where threat actors deployed GSocket, an open-source remote access tool, on compromised Linux servers to maintain persistent access even after vulnerabilities were patched.
Microsoft has identified a growing trend where threat actors are using GSocket, an open-source remote access tool, to maintain persistent access on compromised Linux servers. This technique transforms a single web application compromise into long-term access that outlasts the remediation of original vulnerabilities. The tool's popularity stems from its ability to bypass traditional security measures by using a shared public relay network for traffic, eliminating the need for threat actors to own IP addresses or domains that could be blocked.
According to Microsoft Defender for Endpoint telemetry, GSocket-related detections increased by 356.2% between March and August 2026. The activity is primarily concentrated on web applications and hosting environments, with PHP applications and cPanel hosting accounting for 63.9% of incidents and Apache for 24.3%. Education and research sectors are the most affected, representing 30.7% of compromised organizations, followed by technology and telecommunications at 22.9%.
How GSocket works
GSocket operates through a unique relay model where both the compromised server and the attacker connect outbound to the Global Socket Relay Network, which then pairs the sessions over an end-to-end encrypted channel. This approach eliminates the need for inbound listeners or public IP addresses, making the traffic difficult to detect with traditional firewall rules. The tool identifies endpoints using a shared secret rather than IP addresses or hostnames, allowing attackers to reconnect without knowing the victim's network location.
The same relay model that supports legitimate remote administration also gives threat actors a way to maintain access without operating dedicated C2 infrastructure.
Attack patterns
Threat actors typically follow a similar sequence: compromising an internet-facing application, profiling the host, transferring and concealing the relay tooling, and establishing command and control. They disguise GSocket with kernel-thread-like process names and implement persistence through cron, systemd, shell profiles, and watchdogs. In some cases, attackers attempt to escalate privileges using CVE-2026-43284 (Dirty Frag), a Linux kernel vulnerability that allows elevation to root privileges.
Defense strategies
Organizations should adopt a multi-layered defense approach. First, patch and harden internet-facing applications, keeping web applications, CMS platforms, and plugins current. Second, constrain outbound traffic with deny-by-default egress rules that only allow necessary destinations. Third, harden the host runtime by mounting temporary directories as non-executable where possible. Fourth, audit persistence surfaces like cron entries and systemd units. Finally, enable Microsoft Defender for Endpoint on Linux with behavior monitoring for anomalous processes.
Microsoft emphasizes that remediation must address both the initial compromise and the GSocket deployment. Simply patching the application is insufficient, as the relay client and its persistence mechanisms remain active. Organizations should investigate and remove the GSocket client, associated persistence mechanisms, and staged files, then verify that outbound connections to the relay infrastructure have stopped.
Related
