CVE-2026-43284

Threat Actors Abuse Legitimate GSocket Tool for Stealthy Persistent Access on Linux Servers

Multiple threat actors have been observed abusing the open-source GSocket remote access tool to maintain long-term access to compromised Linux servers, even after initial vulnerabilities are patched. The tool enables attackers to bypass firewalls and NAT by routing traffic through the Global Socket Relay Network, where both the compromised host and the attacker initiate outbound connections. Microsoft Defender for Endpoint telemetry recorded a 356.2% increase in GSocket-related detections between March and August, with 87.1% of incidents targeting web applications and hosting environments. Attackers disguise GSocket as kernel threads and establish persistence via cron jobs, systemd services, and shell startup files. In some cases, they attempted to exploit the Dirty Frag Linux kernel vulnerability CVE-2026-43284 to escalate privileges. Most affected organizations belong to the education, research, technology, manufacturing, and government sectors. Defenders are advised to remove GSocket artifacts, restrict outbound traffic, and audit persistence mechanisms.