Threat Actors Weaponize GSocket for Stealthy Command and Control on Linux Servers
Microsoft reports a significant increase in threat actors leveraging the open-source GSocket tool for persistent command and control on compromised Linux servers, bypassing traditional defenses.
Microsoft has observed a concerning trend where threat actors are weaponizing GSocket, an open-source remote access tool, to maintain persistence on compromised Linux servers. This tactic allows attackers to retain access even after the initial vulnerabilities used for compromise have been remediated, effectively turning a single web application breach into a long-term foothold. Defenders are urged to look beyond simple application patching and investigate for evidence of GSocket deployment, persistence, and outbound connections.
GSocket's effectiveness stems from its ability to bypass common remediation challenges. Unlike traditional methods that rely on fixed command and control (C2) infrastructure, GSocket utilizes a public relay network. This means there is no specific IP address or domain controlled by the threat actor to block. Both the compromised host and the attacker connect outbound to the Global Socket Relay Network, which then bridges the two sessions over an encrypted channel. This outbound-only connection model makes it difficult for firewalls to detect and block, as inbound rules do not see the traffic.
Furthermore, GSocket incorporates built-in evasion and persistence mechanisms. Its deployment script can rename the process, stage files in memory-backed directories, and install persistence that survives reboots without requiring additional development effort from the attacker. This self-sufficiency and resilience explain its adoption by multiple, seemingly unrelated threat actors. The tool's ability to operate independently of the exploited application means that patching the initial vulnerability does not remove the GSocket client or its established persistence.
Telemetry from Microsoft Defender for Endpoint indicates a substantial rise in this activity. From March to August 2026, devices with GSocket-related detections increased by over 350%. The majority of these incidents, approximately 87%, were linked to web applications and hosting environments. Within this category, PHP web applications and cPanel hosting were particularly targeted, accounting for nearly 64% of incidents, with Apache servers also frequently affected.
The observed attack chains typically begin with threat actors exploiting internet-facing web applications to gain initial access. Once inside, they profile the host, transfer and conceal the GSocket tooling, and establish encrypted command and control through the relay network. Some intrusions also involve subsequent stages of persistence and privilege escalation, further solidifying the attacker's presence.
Sectors most affected by this trend include education and research, which accounted for over 30% of targeted organizations, followed by technology and telecommunications. This exposure is likely due to the common practice in these sectors of running large, decentralized web estates that can be harder to inventory and patch effectively.
To mitigate this threat, organizations should implement robust egress filtering and outbound traffic monitoring. Beyond patching exploited applications, it is crucial to actively hunt for GSocket indicators of compromise, including suspicious outbound connections to known relay services and the presence of the GSocket client on systems. Comprehensive endpoint detection and response (EDR) solutions are vital for identifying and responding to these stealthy persistence techniques.