Microsoft Details GSocket Use for Persistent Access to Linux Servers

Nov 11, 2026 · Original article ↗

Summary

Microsoft describes GSocket intrusions on Linux servers, explaining how attackers maintain access through a shared relay after vulnerabilities are patched, and outlines observed techniques, telemetry, and defenses.

Key points

Microsoft observed multiple intrusions in which threat actors exploited internet-facing applications and deployed GSocket on compromised Linux servers, maintaining access after the initial vulnerabilities were patched.
GSocket connects the compromised host and operator outbound through a shared relay, using a shared secret rather than a fixed threat-actor IP address or hostname.
Observed deployment included downloading and staging GSocket, disguising its process, creating persistence through cron, systemd, and shell profiles, and removing deployment artifacts.
In a few observed incidents, threat actors attempted to exploit CVE-2026-43284, also known as Dirty Frag, to escalate privileges from a web-service account.
Microsoft Defender for Endpoint telemetry showed a 356.2% increase in GSocket-related detections from March through August 2026; web applications and hosting accounted for 87.1% of attributable incidents in the analyzed telemetry.
Microsoft recommends investigating and removing GSocket and its persistence—not just patching the application—and provides detection queries, indicators, and guidance for outbound monitoring and host hardening.

Article Details

Attack Vectors: Threat actors exploited internet-facing web applications to execute commands in the web-service context.
After initial access, attackers used curl to retrieve and execute a remote GSocket installation script, which selected and staged a client matching the system architecture.
Some intrusions included attempts to exploit CVE-2026-43284 to escalate privileges from the web-service account to root.
GSocket clients connected outbound through the Global Socket Relay Network to provide a command-and-control channel without a fixed attacker-owned IP address or domain.
Defensive Notes: Patching the initially exploited application alone may not remove GSocket or its persistence. Investigate and remove the client, persistence mechanisms, and staged files, and verify that relay connections have stopped.
Apply deny-by-default egress controls where feasible, allow only required destinations, and monitor outbound connections to relay infrastructure.
Audit cron entries, systemd units, and shell startup files; persistence may be layered across several mechanisms.
Alert on execution from hidden or world-writable paths, suspicious child processes of web services, and process names masquerading as system processes.
Prioritize patching local privilege-escalation vulnerabilities on internet-facing servers, including CVE-2026-43284.

Indicators of compromise

Type	Indicator	Context
SHA256	`12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c`	SHA-256 of the hidden file /tmp/.gsn_ora, identified as HackTool:Linux/GsNetcat.A!MTB.
SHA256	`55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f`	SHA-256 of the masqueraded GSocket binary observed as /tmp/systemd-remount-d and /usr/bin/systemd-remount-d.
SHA256	`d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa`	SHA-256 of a staged x86-64 GSocket client identified as HackTool:Linux/GsNetcat.A!MTB.
SHA256	`f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5`	SHA-256 of a staged AArch64 GSocket client identified as HackTool:Linux/GsNetcat.A!MTB.
URL	`hxxps[:]//cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64`	Observed download source associated with the staged AArch64 GSocket client.
URL	`hxxps[:]//gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64`	Observed download source associated with the staged x86-64 GSocket client.
URL	`hxxps[:]//gsocket[.]io/y`	Script retrieval URL observed in download-and-execute commands used to deploy GSocket.