Microsoft observed multiple incidents in which threat actors deployed GSocket, an open source remote access tool, on compromised Linux servers. Threat actors used Gsocket to maintain access even after the vulnerabilities used for initial compromise were remediated. This turned a single web application compromise into persistent access that outlasted the remediation of the original vulnerabilities. Defenders investigating affected hosts should look for evidence of GSocket deployment, persistence, privilege escalation, and outbound connections, rather than treating application patching alone as complete remediation.

Microsoft Defender for Endpoint telemetry shows this activity growing over recent months and concentrated on web applications and hosting environments. GSocket relays traffic through a shared public network, so there is no threat actor-owned IP address or domain to block.

When one RCE stops being just one RCE

Exploiting a web application vulnerability gives a threat actor command execution in the context of the web server process. That access lasts only while the vulnerability remains unpatched and the service keeps running. Patching the application or restarting the service can remove it.

To keep access, threat actors typically add a persistence mechanism, and each common option has drawbacks. SSH keys added to authorized_keys are easy for administrators to find during an audit. Reverse shells depend on threat actor-controlled servers that defenders can block or sinkhole. Custom implants require ongoing development and maintenance. The same trade-offs apply when initial access comes through remote access services or cloud shell sessions.

GSocket addresses these drawbacks, which helps explain why multiple unrelated threat actors have adopted it.

• Shared relay infrastructure. Traffic passes through the Global Socket Relay Network, a public relay service. The threat actor does not register or host any infrastructure, so there is no threat actor-owned IP address or domain to block. Organizations can still restrict access to the relay itself.
• Outbound-only connections. The compromised host and the operator both connect outbound to the relay, which bridges the two sessions. The host needs no inbound listener or public IP address, and network address translation does not prevent the connection. Inbound firewall rules do not see this traffic, although egress filtering and outbound monitoring can.
• Built-in evasion and persistence. The deployment script can rename the process, stage files in memory-backed directories, and install persistence that survives a reboot, without additional development by the threat actor.

The same relay model that supports legitimate remote administration also gives threat actors a way to maintain access without operating dedicated C2 infrastructure. Once GSocket runs on a compromised server, the server and the operator each connect outbound to the Global Socket Relay Network, which pairs the two sessions over an end-to-end encrypted channel.

Because GSocket runs independently of the exploited application, patching the vulnerability does not remove the relay client or its persistence.

Microsoft Defender for Endpoint telemetry shows that this activity is not limited to a single compromise. From March through August 2026, devices with GSocket-related detections increased 356.2%, although the increase was not consistent month to month.

Web applications and hosting accounted for 87.1% of attributable Microsoft Defender for Endpoint incidents in the analysed telemetry. Within that group, PHP web applications and cPanel hosting represented 63.9% of incidents and Apache represented 24.3% (Figure 3).

Education and research accounted for the largest share of affected organizations (30.7%), followed by technology and telecommunications (22.9%).

These figures reflect the share of affected organizations and do not indicate that threat actors selected these sectors deliberately. Exposure is the more likely factor: academic institutions often run large, decentralized web estates maintained outside central IT, which are harder to inventory and patch.

Observed attack chains

The RCE-based intrusions in this analysis followed a similar sequence after initial access. Threat actors compromised an internet-facing application, profiled the host, transferred and concealed the relay tooling, and used the resulting channel for command and control. Some intrusions also included persistence and privilege escalation. Figure 5 combines these behaviours into a generalized attack chain. Not every stage occurred in every intrusion.

How threat actors deploy and operate GSocket

Initial access and deployment: Threat actors exploited internet-facing web applications and used curl to download and execute a remote script. The script profiled the host, selected a GSocket client matching the system architecture, staged it in writable or memory-backed paths such as /dev/shm, and established encrypted outbound command and control through the Global Socket Relay Network.

Defense evasion and persistence: Threat actors disguised GSocket with kernel-thread-like process names, persisted through cron, systemd, shell profiles, watchdogs, and redundant copies, then removed staging files and other deployment indicators.

Privilege escalation: After gaining execution as the web-service account, in few observed incidents, threat actors attempted to exploit CVE-2026-43284, one of the recent Linux kernel vulnerabilities also known as Dirty Frag, to elevate privileges to root.

How GSocket reconnects without a fixed C2 address

GSocket identifies endpoints by a shared secret instead of an IP address or hostname. During installation, the deployment script typically generates a random secret and writes it to standard output. The threat actor can choose to read the secret from the console, redirect it to a temporary file and retrieve the file before is deleted, or have it delivered through a supported notification channel, such as Telegram (configured with GS_TG_TOKEN and GS_TG_CHATID), Discord, or a webhook. With this secret, the operator can reconnect later from any compatible GSocket client, without knowing the victim’s IP address, hostname, or network location.

A traditional reverse shell connects to a threat actor-controlled IP address written into the payload. GSocket instead derives its connection identifier and authentication material from the shared secret. The compromised host and the operator each connect outbound to the Global Socket Relay Network (GSRN), which matches them and brokers an end-to-end encrypted session. Neither endpoint needs a public IP address, an inbound listener, or a permissive inbound firewall rule.

As a result, blocking an IP address or domain is unlikely to cut off access. The connection relies on a shared relay service, outbound traffic that is commonly permitted, and a secret that does not need to be hardcoded in the payload. Anyone with the shared secret can reconnect through the relay without knowing the compromised host’s IP address or hostname.

Mitigation and protection guidance

For an affected Linux server, remediation should address both the initial compromise and the GSocket deployment.

1. Patch and harden internet-facing applications. Keep web applications, CMS platforms, plugins, and application servers current. Remove unused components and restrict file-upload and administrative paths.
   • Remediate the host as well as the vulnerability. Do not treat application patching as complete remediation. Investigate and remove the GSocket client, associated persistence, and staged files, then verify that outbound connections to the relay infrastructure have stopped
2. Patch and harden internet-facing applications. Keep web applications, CMS platforms, plugins, and application servers current. Remove unused components and restrict file-upload and administrative paths.
3. Constrain outbound traffic. Apply deny-by-default egress rules, allow only required destinations, and monitor connections to relay infrastructure.
4. Harden the host runtime. Mount temporary and memory-backed directories as non-executable where feasible, and alert on execution from hidden or world-writable paths.
5. Audit persistence surfaces. Review cron entries, systemd units with plausible service names, and shell startup files. Persistence is often layered across several mechanisms, so stopping the running process alone does not remove access.
6. Prioritize local privilege-escalation patching on internet-facing servers. In the analyzed activity, threat actors attempted to exploit CVE-2026-43284 to escalate from the web-service account to root. Separately, Microsoft FORGE Lab recently documented 59 Linux kernel bug reports, including eight vulnerabilities for which researchers demonstrated local root privilege-escalation exploits in controlled environments.
7. Enable Microsoft Defender for Endpoint on Linux. Keep real-time and cloud-delivered protection enabled, with behavior monitoring for anomalous child processes of web services and masqueraded process identities.

Microsoft Defender detections

Microsoft Defender for Endpoint provides visibility into activity associated with GSocket-related Linux intrusions, including suspicious shell execution, payload delivery, persistence, defense evasion, and remote communication. The alerts below were observed in the analyzed telemetry. An individual alert does not establish the initial access method or confirm that every stage of an intrusion succeeded.

Microsoft Security Copilot

Security Copilot customers can use the standalone experience to create their own prompts or run prebuilt promptbooks to automate incident response or investigation tasks related to this threat:

• Incident investigation: correlate web-service process ancestry, relay client deployment, persistence changes, and outbound activity into a single timeline for the affected host.
• Threat actor profile: summarize observed GSocket tradecraft and related tooling seen in the environment.
• Device summary: assess the affected Linux host, its exposed application, and follow-on activity after initial execution.

Advanced hunting queries

Microsoft Defender XDR customers can use the following queries to surface GSocket-related activity. The queries use public Advanced Hunting tables populated by Microsoft Defender for Endpoint and cover deployment patterns observed in the analyzed intrusions.

Matches should be investigated in context with process ancestry, execution context, persistence changes, and related network activity.

GSocket process activity

Looks for GSocket tooling by name or command line.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has_any ("gs-netcat", "gsocket")
    or ProcessCommandLine has_any ("gsocket.io", "gs-netcat", "gsnetcat")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
    ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Installer download activity

Looks for the download-and-execute pattern used to fetch GSocket.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "gsocket.io"
    or ProcessCommandLine has "gsgg.b-cdn.net"
| project Timestamp, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Connections to observed distribution hosts

These are tool distribution endpoints, not threat actor-owned command and control.

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("gsocket.io", "gsgg.b-cdn.net")
| project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, RemotePort,
    InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

Known file hashes

Matches the SHA-256 hashes published in the indicators of compromise section.

let badSHA256 = dynamic([
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5",
    "55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f",
    "12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c"
]);
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in~ (badSHA256)
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Staging and persistence artifacts

Useful when hashes are missing or a different build is used.

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath startswith "/dev/shm/.gs-"
    or FileName in~ ("systemd-remount-d", ".gsn_ora", "defunct", "defunct.service")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

MITRE ATT&CK techniques observed

The following techniques were observed across the analyzed intrusions. Not every technique occurred in every intrusion, and some outcomes, such as persistence across reboot and successful relay session establishment, were not confirmed in every case.

Initial access

• T1190 Exploit Public-Facing Application | Internet-facing web applications were exploited to gain command execution in the web service context. Follow-on commands were launched as children of web server and application runtime processes, consistent with exploitation of an exposed application.

Execution

• T1059.004 Command and Scripting Interpreter: Unix Shell | Commands used curl to retrieve the GSocket installation script and executed it with bash.
  Additional bash invocations launched the renamed payload.

Execution, Persistence

• T1053.003 Scheduled Task/Job: Cron | Cron entries were created in the same detection window as GSocket deployment script activity, consistent with persistence.

Persistence

• T1543.002 Create or Modify System Process: Systemd Service | Activity launched a bash command invoking the renamed /usr/bin/defunct payload and referenced defunct.service and a multi-user.target.wants link.

Defense evasion

• T1036 Masquerading | A GsNetcat binary executed as systemd-remount-d, a system service-like filename. In a separate execution context, bash used exec -a to present /usr/bin/defunct with the argument-zero name [kaluad].
• T1564.001 Hide Artifacts: Hidden Files and Directories | gs-netcat payloads were staged under the dot-prefixed /dev/shm/.gs-0 directory. A GsNetcat-detected file was also observed at /tmp/.gsn_ora.
• T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification | chmod changed permissions on the renamed payload, including chmod 700 /usr/bin/defunct.
• T1070.006 Indicator Removal: Timestomp | touch commands applied older timestamps to /usr/bin/defunct and defunct.service. Timestamp copy operations targeted the system service-like payload name.
• T1070.004 Indicator Removal: File Deletion | rm removed the staged /dev/shm/.gs-0/gs-netcat file, and a separate rmdir command removed the staging directory.

Command and control

• T1105 Ingress Tool Transfer | curl downloaded gs-netcat payloads from GSocket distribution endpoints into /dev/shm/.gs-0.
• T1090.002 Proxy: External Proxy | GSocket clients were launched with options that establish outbound sessions to the Global Socket Relay Network, a shared public relay that brokers the connection between the compromised host and the operator. The relay is third-party infrastructure and is not owned by the threat actor.

Indicators of compromise

The indicators below were observed in the analyzed telemetry. They represent specific observations from these intrusions rather than a complete inventory of GSocket tooling or infrastructure.

References

1. The Hacker’s Choice. “GSocket.” GitHub. https://github.com/hackerschoice/gsocket
2. Microsoft Defender Security Blog: Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments
   https://www.microsoft.com/en-us/security/blog/2026/04/02/cookie-controlled-php-webshells-tradecraft-linux-hosting-environments/
3. Elastic Security Labs: Betting on Bots
   https://www.elastic.co/security-labs/threat-command/betting-on-bots
4. SANS Internet Storm Center: GSocket Backdoor Delivered Through Bash Script
   https://isc.sans.edu/diary/32816
5. Sansec: Found defunct.dat on Your Site? You’ve Got a Problem https://sansec.io/research/gsocket

Learn More

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.  

• Learn more about securing Copilot Studio agents with Microsoft Defender 
• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation
• How Microsoft discovers and mitigates evolving attacks against AI guardrails
• Prompt injection protection in Microsoft Defender for Office 365 – official documentation of the prompt injection protection in Microsoft Defender for Office 365.
• How Microsoft discovers and mitigates evolving attacks against AI guardrails | Microsoft Security Blog
• Manipulating AI memory for profit: The rise of AI Recommendation Poisoning | Microsoft Security Blog – a related example of an AI-era technique observed in email traffic
• Defending the inbox against prompt injection attacks | Microsoft Defender for Office 365 Blog – feature announcement introducing prompt injection protection in Microsoft Defender for Office 365.
• Learn how Microsoft is reimagining the SOC for the agentic era with ISOC in Microsoft Defender