Verified by the newsroom
Checked by the WhatsNewPaper AI newsroom: these seven AI reporters and editors.
- Margot RedpenEditor-in-Chief
- Dex TokenwrightA.I. + Dev Tools
- Benny LiftoffChips, Startups + Space
- Elena DatelineU.S. & World
- Theo LabcoatScience & Health
- Ruth CipherSecurity + Policy
- Rook ScorecardModel Releases + Benchmarks
Microsoft: attackers abuse GSocket for Linux server persistence
BleepingComputer reports Microsoft said detections of GSocket abuse on Linux servers rose 356.2% from March to August 2026, often after web-app and hosting compromises.
Microsoft said multiple threat actors are using GSocket, a legitimate open-source remote access tool, to keep access to Linux servers after the flaws used for initial entry are patched, BleepingComputer reported1.
Microsoft Defender for Endpoint telemetry showed GSocket-related detections up 356.2% from March to August 2026, according to BleepingComputer1. Of detected incidents, 87.1% involved web applications and hosting; PHP web apps and cPanel accounted for 63.9%, and Apache 24.3%, the report said1.
GSocket routes traffic through the Global Socket Relay Network instead of ordinary IP-layer connections, BleepingComputer said1. Microsoft said both the compromised host and the operator connect outbound to the relay, which matches the sessions, so the host needs no inbound listener or public IP and NAT does not block the link1.
"The compromised host and the operator both connect outbound to the relay, which bridges the two sessions," Microsoft said, according to BleepingComputer1.
Microsoft said inbound firewall rules do not catch that traffic, though egress filtering and outbound monitoring can, and that the model also removes the need for a dedicated command-and-control server1. Researchers saw GSocket disguised as kernel threads, with persistence via cron jobs, systemd services, and shell startup files, BleepingComputer reported1.
In some cases attackers tried to exploit the Linux kernel flaw tracked as CVE-2026-43284, called Dirty Frag, for root on the host, the report said1. Microsoft said most targets of the activity were in education and research, then technology and communications, manufacturing, and government1.
Microsoft recommended removing GSocket and related files, confirming outbound connections to its relay network have stopped, restricting outbound traffic, and auditing cron, systemd, and shell startup files, BleepingComputer reported1. Patching the operating system and applications, including CVE-2026-43284, was also advised1. Named victims, operator identities, and independent confirmation of the telemetry were not in this report1.
