Attackers use GSocket to keep access to patched Linux servers

Because the tool connects outward to a relay, blocking known IP addresses or domains is much less effective against it.

Several threat groups are using GSocket, a legitimate open-source remote access tool, to keep hold of Linux servers even after the flaws they first used to get in have been patched. Microsoft Defender for Endpoint telemetry recorded a 356.2% rise in GSocket-related detections between March and August. Because both the compromised machine and the attacker connect outward to a relay network, no inbound listener or public address is needed, and IP- or domain-based blocking becomes far less effective. Most of the detected activity hit web applications and hosting environments, with PHP apps and cPanel accounts making up 63.9%. Microsoft's guidance is to remove GSocket and its files, confirm outbound relay connections have stopped, restrict outbound traffic to approved destinations, audit cron jobs, systemd services and shell startup files, and patch promptly, including for CVE-2026-43284.