GSocket on Linux servers: Microsoft counts 356% rise in detections since March, how to hunt it

Microsoft says attackers are installing GSocket, a legitimate open source remote access tool, on hacked Linux web servers so that they keep access after the original hole is patched. In an 11 November 2026 report built on Microsoft Defender for Endpoint telemetry, the company counted a 356.2% rise in devices with GSocket detections between March and August 2026, mostly on PHP and cPanel hosting. Because GSocket meets its operator through a shared public relay, there is no attacker server to block, and fixing the vulnerable application does not remove the implant.

Key points

• Microsoft reports that several unrelated threat actors deployed GSocket on compromised Linux servers to keep access after the initial vulnerability was fixed.
• From March through August 2026, devices with GSocket-related detections rose 356.2%, although Microsoft says the increase was not consistent from month to month.
• Web applications and hosting made up 87.1% of attributable incidents; PHP web applications and cPanel hosting accounted for 63.9% of incidents and Apache for 24.3%, in Microsoft's figures.
• In a few observed incidents the attackers tried to use the Dirty Frag kernel flaw CVE-2026-43284 to go from the web-service account to root.
• Microsoft's advice: patching the application is not enough; remove the client and its persistence, then confirm that outbound traffic to the relay has stopped.

What to do

1. Hunt for the known artefacts. Microsoft lists these from the intrusions it analysed: a hidden staging directory /dev/shm/.gs-0, a file at /tmp/.gsn_ora, a binary named systemd-remount-d, and a payload called /usr/bin/defunct with a matching defunct.service unit. Look for processes launched with names that imitate kernel threads.
2. Search logs and egress records for the download hosts. Microsoft names gsocket[.]io, cdn[.]gsocket[.]io and gsgg[.]b-cdn[.]net as places the script and client binaries came from. It stresses these are distribution endpoints, not attacker-owned command servers, so a hit shows the tool was fetched, not who used it. The post also lists four SHA-256 hashes, and Defender XDR customers get ready-made hunting queries in the original report.
3. Audit every persistence surface. Review cron entries, systemd units with plausible service names and shell startup files. Microsoft says persistence is often layered, so killing the running process does not end the access.
4. Remove, then verify. Delete the client, its persistence and staged files, then check that outbound connections to the relay have stopped. If you cannot say how the intruder got in, rebuild the host.
5. Close the door they used. Patch web applications, CMS platforms and plugins, remove unused components, and restrict upload and admin paths.
6. Cut the egress. Use deny-by-default outbound rules and monitor connections to relay infrastructure; inbound firewall rules do nothing against a client that dials out. Mount temporary and memory-backed directories as non-executable where you can.
7. Patch local privilege escalation on internet-facing servers, including CVE-2026-43284 (below).

What happened

Microsoft's post, "The global socket: how threat actors are weaponizing GSocket for stealthy C2", describes multiple incidents in which attackers exploited an internet-facing web application, then used curl to download and run a remote script. The script profiled the host, picked a GSocket client matching its architecture, staged it in a writable or memory-backed path such as /dev/shm, and opened an encrypted outbound connection to the Global Socket Relay Network.

Then the attackers hid it. Microsoft says they disguised the process with kernel-thread-like names, kept it alive through cron, systemd, shell profiles, watchdogs and redundant copies, and deleted the staging files and other deployment traces. In its example the client ran as systemd-remount-d, and in another a payload was moved to /usr/bin/defunct with its timestamps set to older dates.

BleepingComputer reported the research on 12 November and added that, by Microsoft's account, most targets were in education and research, followed by technology and communications, manufacturing and government.

Background: why GSocket suits attackers

GSocket (Global Socket) is an open source tool, maintained by the group hackerschoice, that lets two machines on different private networks talk "through firewalls and through NAT", according to the project's site. A typical use is exposing an SSH service on a machine with no public address: both ends use the same secret, and the tool pairs them.

That is also what an intruder wants. Microsoft explains that classic reverse shells connect to an address written into the payload, which defenders can block once they find it. GSocket derives its connection identifier and authentication from a shared secret instead. The compromised host and the operator each connect outbound to the relay network, which matches them and brokers an end-to-end encrypted session. Neither side needs a public IP address, a listener, or a permissive inbound rule. Microsoft's conclusion: blocking an IP address or domain is unlikely to cut off access, because the connection relies on a shared relay, on outbound traffic that is commonly allowed, and on a secret that is not hard-coded in the payload.

The secret is chosen at install time. The deployment script typically generates a random one and prints it; the operator can read it from the console, redirect it to a temporary file and fetch it before deletion, or have it delivered through a notification channel such as Telegram (configured with GS_TG_TOKEN and GS_TG_CHATID), Discord or a webhook. With the secret, the operator can come back later from any compatible GSocket client without knowing the victim's address.

The numbers

Microsoft's telemetry gives three figures worth keeping apart. The 356.2% growth is the change in the number of devices with GSocket-related detections from March through August 2026, measured against the March baseline, and Microsoft notes it was not steady month to month. The 87.1% is the share of attributable Defender for Endpoint incidents in the analysed telemetry that involved web applications and hosting. Within that group, PHP web applications and cPanel hosting made up 63.9% of incidents and Apache 24.3%.

These are Microsoft's counts from its own customers' devices, not a measure of the whole internet, and Microsoft calls its list of indicators "specific observations from these intrusions rather than a complete inventory of GSocket tooling or infrastructure". A clean result on the artefacts above does not prove a server is clean.

Where Dirty Frag fits

In a few incidents, after getting code execution as the web-service account, the attackers tried CVE-2026-43284 to reach root. That is one half of Dirty Frag, a Linux local privilege escalation that chains two page-cache write flaws: one in the xfrm-ESP path (CVE-2026-43284, present since January 2017) and one in RxRPC (CVE-2026-43500, since June 2023). The Hacker News reported in May 2026 that it was reported to kernel maintainers on 30 April, that a public proof of concept reportedly gains root with one command, and that distributions including Debian, Red Hat, SUSE, Rocky Linux and Amazon Linux published advisories. Before patches arrived, the suggested stopgap was to block the esp4, esp6 and rxrpc kernel modules. Microsoft separately points to its FORGE Lab's documentation of 59 Linux kernel bug reports, eight of them with demonstrated local root exploits in controlled environments.

What it means

For hosting providers and anyone running cPanel or PHP stacks, the lesson is about incident scope: the patch ends the vulnerability, not the intrusion. Microsoft's guidance is explicit: "Do not treat application patching as complete remediation."

For defenders, detection has to move from network indicators to the host and to outbound behaviour. A shared relay means threat intelligence feeds of attacker IPs will not catch it; process ancestry (shell commands launched by a web server), odd names in /dev/shm, new systemd units and cron lines will.

For GSocket's maintainers and users there is a dual-use cost. The same features that make it handy for administrators make it attractive to intruders, and its use in a company is not proof of compromise. Tell the two apart by whether you installed it.

What we don't know yet

• How many servers outside Microsoft's telemetry are affected. The figures cover its own customers' devices.
• Who the actors are. Microsoft says they are multiple, and the post does not name them.
• The initial vulnerabilities in each case; Microsoft describes exploitation of internet-facing web applications in general terms.

What to watch next

Watch for updated guidance and indicators from Microsoft, for hosting providers publishing their own clean-up notes, and for distribution advisories on the Dirty Frag CVEs. If you run Defender for Endpoint on Linux, keep real-time and cloud-delivered protection on, since Microsoft says its alerts cover shell execution, payload delivery, persistence and relay communication, and an individual alert does not by itself prove how the intruder got in.

Sources

• The global socket: how threat actors are weaponizing GSocket for stealthy C2 (Microsoft Security Blog, 11 November 2026)
• Hackers plant GSocket on Linux servers for persistent access (BleepingComputer)
• Linux kernel Dirty Frag LPE exploit (The Hacker News)
• Global Socket project site (gsocket.io)