The global socket: how threat actors are weaponizing GSocket for stealthy C2
Source Microsoft Security Blog
Rated High by Threat Radar's AI analysis
Data as of 11 Nov 2026, 20:51 UTC
What to do
AI-suggested
There is no indication that patching the initial exploited vulnerability alone is sufficient to remediate GSocket-based persistence. Defenders should actively search for signs of GSocket deployment, including renamed processes resembling kernel threads, files staged in memory-backed directories (e.g., /dev/shm), persistence mechanisms via cron, systemd, shell profiles, and watchdogs, as well as unusual outbound connections to the Global Socket Relay Network. Network egress filtering and outbound connection monitoring can help detect and restrict GSocket traffic. Organizations can also consider restricting access to the public relay infrastructure used by GSocket. Comprehensive incident response should include removing GSocket components and persistence mechanisms from affected hosts.
Description
GSocket is an open source remote access tool weaponized by threat actors to maintain persistent access on compromised Linux servers, especially web applications and hosting environments. It uses a public relay network for command and control, avoiding direct threat actor infrastructure and evading traditional inbound firewall rules. This allows attackers to maintain access even after patching the initial vulnerability. GSocket employs outbound-only encrypted connections, process renaming, memory-backed staging, and persistence mechanisms that survive reboots, complicating detection and remediation. Microsoft telemetry shows a significant increase in GSocket-related detections, primarily targeting PHP web applications and Apache servers in education and technology sectors. Defenders should focus on detecting GSocket deployment, persistence, privilege escalation, and outbound connections rather than relying solely on patching the exploited application.