Multiple threat actors are reportedly abusing GSocket, an open-source remote access tool, to maintain access to Linux servers. This activity persists even after vulnerabilities used for initial access have been patched, according to sources.
GSocket enables attackers to bypass firewalls and NAT by intercepting network connections and replacing conventional IP-layer communication with its own transport layer. This capability has been exploited to maintain persistent access to compromised systems.
Microsoft Defender for Endpoint telemetry indicates a 356.2% increase in GSocket-related detections from March to August 2026. The majority of incidents, 87.1%, are linked to web applications and hosting environments, particularly PHP web apps and cPanel hosting.
The education and research sector is the most targeted by this activity, followed by technology and telecommunications, manufacturing, and government entities. Attackers have been observed disguising GSocket as kernel threads and using cron jobs, systemd services, and shell startup files for persistence.
In some instances, attackers attempted to exploit the 'Dirty Frag' Linux kernel flaw (CVE-2026-43284) to gain root privileges. Both the compromised host and the operator connect to the Global Socket Relay Network, facilitating an encrypted communication channel.
Microsoft advises system administrators to remove GSocket and associated files from potentially impacted servers and ensure that outbound connections to its relay network have ceased.