Patching the hole an attacker came through is not enough if they got in on a Linux web server, Microsoft warns. Its security researchers have seen several intrusions where the attacker installed GSocket, a free remote access tool, and kept control of the machine long after the original bug was fixed.
The detections are climbing. Microsoft Defender for Endpoint logged 356.2% more devices with GSocket-related alerts in August than in March, though the climb was bumpy, with dips along the way. Most cases involve PHP web applications and Apache, which makes web hosting servers the main target.
The attack starts with a flaw in an internet-facing application that gives the attacker command execution. Next comes a curl command. According to Microsoft’s research post, it fetches an install script that profiles the server and chooses the right GSocket build for its chip. The client lands in a temporary location such as /dev/shm, and the traces of the install are wiped afterwards.
The part that makes GSocket hard to block is how it finds its way home. A normal reverse shell calls an address the attacker owns, which defenders can blacklist. GSocket does not. Instead, a secret generated at install time acts as the meeting point: both sides dial out to the public Global Socket Relay Network, which matches them up. There is no attacker-owned IP or domain to block, and no inbound port needs to be open.
The attacker can have that secret sent to a Telegram chat, a Discord channel or a webhook, or read it off the console, and can return from any GSocket client later. To stay hidden, the running process borrows names that resemble kernel threads. To stay alive, it leans on several tricks at once: scheduled cron jobs, systemd units, edits to shell profiles, watchdogs and backup copies of the binary.
The advice for admins is to treat the server as compromised rather than just unpatched. Look for GSocket and gs-netcat processes, cron and systemd entries created around the same time, files under /dev/shm, and outbound connections to gsocket.io. Remove the client and its persistence, then confirm the relay traffic has stopped. Microsoft supplies Defender XDR hunting queries that search for the tool by name and for the curl download pattern.
GSocket itself is a legitimate remote administration tool, and Microsoft says several unrelated groups have adopted it. That is why the company wants defenders to hunt for it directly instead of waiting for an attacker-specific signature.
