Threats tagged 'web application exploitation'

Multiple threat actors have been using GSocket, an open source remote access tool, to maintain persistent access on compromised Linux servers, especially targeting web applications and hosting environments. The activity surged by over 350% between March and August 2026, with education and research sectors notably affected. GSocket uses a shared public relay network for command and control, bypassing traditional infrastructure that defenders can block. Attackers deploy GSocket with renamed processes in memory-backed directories and establish persistence via cron and systemd. Some attacks involve privilege escalation exploiting CVE-2026-43284. The tool's outbound-only connections and shared relay infrastructure complicate detection and remediation.