Threat Actors Weaponizing GSocket for Stealthy C2

Microsoft has observed a significant increase in the use of GSocket, an open-source remote access tool, by threat actors targeting Linux-based web applications and hosting environments. The tool allows attackers to maintain persistent access that survives application patching and service restarts by leveraging a public relay infrastructure, effectively bypassing traditional IP-based blocking and inbound firewall rules.

The attack chain typically begins with the exploitation of internet-facing web applications (predominantly PHP and Apache), followed by host profiling and the deployment of the GSocket client. In some instances, actors attempted to escalate privileges to root using CVE-2026-43284 (Dirty Frag). GSocket is particularly dangerous because it uses outbound-only connections to the Global Socket Relay Network (GSRN) and identifies endpoints via a shared secret rather than a static IP address.

This threat is especially prevalent in the education, research, and technology sectors. Organizations must recognize that patching the initial vulnerability is insufficient for remediation; defenders must proactively hunt for GSocket persistence mechanisms, such as systemd services and cron jobs, and monitor for unauthorized outbound relay connections.