Threat Actors Abuse Legitimate GSocket Tool for Stealthy Persistent Access on Linux Servers

Multiple threat actors have been observed abusing the open-source GSocket remote access tool to maintain long-term access to compromised Linux servers, even after initial vulnerabilities are patched. The tool enables attackers to bypass firewalls and NAT by routing traffic through the Global Socket Relay Network, where both the compromised host and the attacker initiate outbound connections. Microsoft Defender for Endpoint telemetry recorded a 356.2% increase in GSocket-related detections between March and August, with 87.1% of incidents targeting web applications and hosting environments. Attackers disguise GSocket as kernel threads and establish persistence via cron jobs, systemd services, and shell startup files. In some cases, they attempted to exploit the Dirty Frag Linux kernel vulnerability CVE-2026-43284 to escalate privileges. Most affected organizations belong to the education, research, technology, manufacturing, and government sectors. Defenders are advised to remove GSocket artifacts, restrict outbound traffic, and audit persistence mechanisms.

BleepingComputerNovember 12, 2026Translated from English

Read at source

Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access.

Since March, detections of malicious GSocket activity have increased, particularly in attacks targeting web applications and hosting environments. GSocket allows attackers to reach systems behind firewalls or NAT by intercepting network connections and replacing the program's conventional IP-layer communication with its own transport layer, which routes traffic through the Global Socket Relay Network.

Since both endpoints initiate outbound connections to the relay, which matches them and brokers an end-to-end encrypted session, an attacker can reconnect without needing the compromised server's IP address or hostname. This makes it more difficult for defenders to disrupt attacks using IP- or domain-based access control lists.

According to Microsoft Defender for Endpoint telemetry, GSocket-related detections increased by 356.2% between March and August. Microsoft explains that both the compromised server and the attacker connect outbound, hence the server needs no inbound listener implants, making the attack stealthier.

“The compromised host and the operator both connect outbound to the relay, which bridges the two sessions,” Microsoft explains. “The host needs no inbound listener or public IP address, and network address translation does not prevent the connection.”

The same model also removes the need for attackers to use a dedicated command-and-control (C2) server. Microsoft says inbound firewall rules don’t catch the malicious traffic, although egress filtering and outbound monitoring can.

Of the detected incidents, 87.1% related to web applications and hosting. PHP web apps and cPanel hosting accounted for 63.9%, and Apache accounted for 24.3%.

The researchers observed attackers disguising GSocket as kernel threads and using cron jobs, systemd services, and shell startup files for persistence purposes. In some cases, the attackers attempted to exploit the “Dirty Frag” Linux kernel flaw (CVE-2026-43284) to gain root privileges on the host.

Microsoft says most targets of GSocket activity are in the education and research sector, followed by technology and communications, manufacturing, and government entities.

The researchers recommend that system administrators remove GSocket and associated files from potentially impacted servers, and verify that outbound connections to its relay network have stopped. They also advise restricting outbound traffic to predetermined destinations and auditing cron jobs, systemd services, and shell startup files for rogue additions. Generally, keeping the OS and applications up to date, including patching for CVE-2026-43284, is a strong measure against this and other attacks.

GSocket cPanel Apache CVE-2026-43284

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Malware & Botnets

Malware & Botnets

Threat Actors Deploy SCKit Malware Toolkit Through Compromised ConnectWise ScreenConnect Panels

A threat actor compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a coordinated campaign reported by Huntress. The attacks began on November 11 when unauthorized access to cloud-hosted ScreenConnect panels was used to execute commands on managed endpoints. At least six managed service providers and 288 hosts across 48 organizations were affected, with all compromised hosts hit within a 90-minute window. Attackers deployed rogue ScreenConnect clients along with the SCKit malware toolkit, which establishes persistent backdoor access, intercepts session cookies, and attempts self-replication by infecting technician workstations. The campaign exploited an authentication flaw in the third-party RMM+ extension for ScreenConnect versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank. ConnectWise responded by disabling five related extensions across approximately 400 environments, and both Huntress and ConnectWise released indicators of compromise.

SecurityWeekNov 12, 2026Translated from English

Malware & Botnets

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has disabled five third-party extensions after reports of unauthorized access to partner environments. The company found no evidence of compromise to its own infrastructure or vulnerabilities in ScreenConnect software. Huntress observed attackers using compromised panels to deploy rogue clients, infecting 288 endpoints across 48 organizations. The attack spreads in a worm-like manner from endpoints to technician workstations and then to additional panels. SCKit toolkit establishes persistence, steals session cookies, and relays commands through the Shared Toolbox feature. Sophos confirmed similar activity originating from three specific ScreenConnect instance IDs. Partners are advised to review Run Command history and monitor for unusual logins and extension activity.

The Hacker NewsNov 12, 2026Translated from English

Malware & Botnets

eBPF Rootkits Spread Underground with Code for Stealthy Linux Implants

eBPF technology, long praised for legitimate Linux kernel observability and networking, is now being weaponized by underground actors to create rootkits that evade traditional detection. Flare research uncovered Russian-language forum posts on Duty Free sharing full source code and tutorials for implants that hide processes via getdents64 hooks, activate via crafted TCP SYN packets, and encrypt C2 traffic with AES-256-GCM. Historical examples include BPFDoor used by Red Menshen, Symbiote’s dynamic linker preload technique, and the more recent LinkPro discovered by Synacktiv after a Jenkins compromise. Public research tools such as ebpfkit, TripleCross, and Boopkit demonstrated the same capabilities years earlier at Black Hat and DEF CON. Defenders are advised to restrict unprivileged BPF access, regularly audit programs with bpftool, and monitor for unexpected XDP attachments and magic packets.

BleepingComputerNov 11, 2026Translated from English