Red Team

Attackers turn GSocket relay into hard-to-block C2 on Linux servers

Microsoft says Linux devices with GSocket detections rose 356% as attackers use its public relay for C2 that outlives patching and dodges IP blocklists.

Abstract network diagram of a Linux server connecting outbound through a public relay, illustrating GSocket command and control.

Microsoft says several unrelated threat actors are planting the open-source GSocket relay tool on compromised Linux web servers, so they keep a way back in long after the original bug is patched. Devices with GSocket-related detections rose by more than 350% between March and August 2026, and the technique leaves defenders with no attacker IP address or domain to block.

What happened

On 11 November 2026 Microsoft published research into a persistence technique it has seen across multiple intrusions on internet-facing Linux hosts. In the intrusions described, the attacker first gained command execution through a vulnerable web application, then installed GSocket, a legitimate open-source networking utility from The Hacker’s Choice, to turn that brief foothold into durable remote access.

The figures come from Microsoft Defender for Endpoint telemetry. Devices with GSocket-related detections grew by 356.2% from March to August, although Microsoft notes the climb was uneven month to month. Of the incidents it could attribute, 87.1% involved web applications and hosting. Within that slice, PHP applications and cPanel hosting made up 63.9% and Apache 24.3%. Education and research organisations accounted for the largest share of victims at 30.7%, with technology and telecoms next at 22.9%.

Microsoft says the sector split probably reflects exposure rather than deliberate targeting, since universities run sprawling, devolved web estates. The tool itself is not new to defenders. The SANS Internet Storm Center documented a Bash dropper for it in March, and e-commerce security firm Sansec has tracked it on compromised online shops since at least 2025.

The technical picture

The appeal of GSocket to an intruder is architectural. Victim and operator each dial out to the Global Socket Relay Network, which is open to anyone, and pair up using a shared secret. Nothing listens on the victim, no port is opened, and there is no attacker-owned server in the traffic path. As Microsoft puts it, there is “no threat actor-owned IP address or domain to block”.

That sidesteps the weaknesses of older methods: a planted SSH key shows up in an audit, a reverse shell needs a callback server that can be blocklisted, and a bespoke implant needs ongoing development.

The intrusion pattern Microsoft describes runs in broad stages, though not every stage appeared every time:

  • Initial access: a flaw in a public-facing web application gives the attacker shell commands under the web server account.
  • Staging: a remote installer script profiles the host, picks a matching client binary and drops it into hidden or memory-backed locations such as /dev/shm.
  • Masquerade and persistence: binaries take names that look like kernel threads or system services, such as “systemd-remount-d” or “[kaluad]”, and persistence is layered across cron, systemd units, shell start-up files, watchdogs and redundant copies.
  • Clean-up: attackers backdate file timestamps, delete staging files and try to wipe shell history.
  • Escalation: in a few cases they attempted CVE-2026-43284, the recent Linux kernel bug dubbed Dirty Frag, to move from the web account to root.

The secret is the real crown jewel. Operators retrieve it from the console, from a temporary file, or have it pushed to them via Telegram, Discord or a webhook. Anyone holding it can reconnect from anywhere without knowing the victim’s address. Sansec has seen criminals mass-scanning shops for the files that hold GSocket keys, in effect hunting for each other’s backdoors, and found some stores reinfected up to seven times after clean-ups missed the root problem. SANS described a variant that disguised its secret as an SSH private key file and tracked and restored file timestamps to frustrate forensics.

Flow diagram of a GSocket intrusion: web application exploit, client staging, disguise and persistence, covering tracks, relay-based command and control, and privilege escalation attempts.

Why it matters for UK organisations

The victim profile maps onto stretched parts of the UK economy. Many British universities run large numbers of departmental sites and research portals, often on Linux and outside central IT. Many small businesses, charities and retailers sit on shared cPanel hosting with PHP stacks. Those are exactly the environments Microsoft’s numbers point to.

The bigger issue is how incidents get closed. A typical UK response to a compromised website is to patch the plugin, restore the site files, perhaps rotate a password, and move on. GSocket survives all of that because it lives outside the application. If the host is not rebuilt or examined, the attacker keeps a quiet route into a server that may sit beside student records, research data or a payment flow, which is an awkward position under UK GDPR if data later leaves.

The technique also exposes the gap between inbound and outbound controls. Many UK organisations have tight inbound firewall rules on their web servers and almost none on egress. A relay-based tunnel is designed for exactly that blind spot.

Expert view

None of this is exotic. GSocket is not a new tool, and in my experience red teams reach for relay tools for the same reason criminals do: they work through almost any firewall and look boring on the wire. What has changed is scale. A more than fourfold rise between March and August tells me commodity operators, not just skilled crews, have absorbed the idea that a web shell is temporary and a relay agent is for keeps.

When we test Linux web estates, the persistence checks are usually the weakest part of the defensive story. Teams monitor the application but rarely baseline cron, systemd units or what is running from /dev/shm. A process masquerading as a kernel worker will sail past someone eyeballing a process list, and one compromised server can end up with several unrelated tenants.

The lesson I would stress is the one Microsoft makes plainly: patching the entry point is not remediation. If a web server has run attacker commands, treat the whole host as untrusted until proven otherwise.

What to do now

  1. Rebuild, do not just patch. Where a public web server has been compromised, rebuild it from a known-good image and rotate every credential it held. If rebuild is impossible, hunt specifically for relay clients, unusual cron entries, recently created systemd units and binaries in hidden or temporary directories.
  2. Restrict egress. Apply deny-by-default outbound rules with an allow-list, and alert on traffic to GSocket relay and distribution infrastructure. This extends the Cyber Essentials firewall control to the direction most people forget.
  3. Harden temporary storage. Mount /tmp, /dev/shm and similar paths with noexec where the application allows, and alert on execution from world-writable or hidden locations (Cyber Essentials secure configuration).
  4. Patch kernels on exposed hosts quickly. Local privilege escalation turns a web account foothold into root. Prioritise CVE-2026-43284 and similar fixes on internet-facing servers (security update management).
  5. Watch for web processes spawning shells. A PHP, Java or Node process launching bash, curl or a download-and-run sequence deserves an alert in its own right. Deploy endpoint detection on Linux servers, not only on laptops (malware protection).
  6. Know your estate. Universities and multi-site organisations should inventory every public web host, including departmental and legacy sites, and assign an owner to each.

Bottom line

GSocket shows how cheaply an attacker can turn a one-off web bug into lasting access that ignores IP blocklists and inbound firewalls. Treat any confirmed web server compromise as a host compromise, lock down outbound traffic, and check persistence locations as routinely as you check patch levels.

Sources

Related Posts