Patching a hacked web application does not necessarily lock the attacker out. Microsoft says multiple threat actors are installing GSocket, a free, open-source remote access tool, on compromised Linux servers so they keep encrypted access long after the original vulnerability has been fixed. The report comes from Microsoft researchers Yash Gund and Sumith Maniath.
The activity is growing. Between March and August 2026, the number of devices with GSocket-related detections in Microsoft Defender for Endpoint telemetry rose 356.2%, although not steadily month to month. Web applications and hosting accounted for 87.1% of attributable incidents, and within that group PHP web applications and cPanel hosting made up 63.9% and Apache 24.3%. Education and research was the most affected sector, at 30.7% of affected organizations, followed by technology and telecommunications at 22.9%. Microsoft cautions that this most likely reflects exposure rather than deliberate targeting: universities often run large, decentralized web estates that are hard to inventory and patch.
There is no attacker server to block
Most ways of hanging on to a hacked server leave something behind for defenders. An SSH key shows up in an audit, and a reverse shell points at an attacker-controlled address that can be blocked. GSocket sidesteps both. Its traffic passes through the Global Socket Relay Network, a public relay service. The compromised server and the operator each connect outbound to it, and the relay pairs them over an end-to-end encrypted channel. The server needs no inbound listener or public IP address, and the attacker registers no infrastructure of their own.
Instead of an address, the two ends find each other with a shared secret. The deployment script can hand that secret to the operator through Telegram, Discord or a webhook, and anyone holding it can reconnect later without knowing where the server is. Because GSocket runs independently of the exploited application, patching the application does not remove it.
From one web bug to a hidden root foothold
In the intrusions Microsoft analyzed, attackers exploited an internet-facing web application, then used curl to fetch and run a script that profiled the host, picked a GSocket client matching its architecture and staged it in memory-backed paths such as /dev/shm. They disguised the process with kernel-thread-like names and layered persistence across cron, systemd units, shell profiles, watchdogs and redundant copies, then deleted staging files. In one case a GSocket binary ran as systemd-remount-d; in another a payload at /usr/bin/defunct was presented as [kaluad] and given backdated timestamps.
In a few incidents the attackers also tried to exploit CVE-2026-43284, one of the Linux kernel flaws known as Dirty Frag, to escalate from the web service account to root.
Clean the host, not just the application
Microsoft's core message is that application patching alone is not complete remediation. It recommends that defenders:
- find and remove the GSocket client, its persistence and staged files, then verify that outbound connections to the relay have stopped;
- audit cron entries, systemd units with plausible service names and shell startup files, since stopping the running process alone does not remove access;
- apply deny-by-default egress rules and monitor connections to relay infrastructure;
- mount temporary and memory-backed directories as non-executable where feasible, and alert on execution from hidden or world-writable paths;
- prioritize local privilege-escalation patches on internet-facing servers.
Indicators
Microsoft notes that the domains below are GSocket's distribution hosts, not attacker-owned command and control:
- gsocket[.]io, cdn[.]gsocket[.]io and gsgg[.]b-cdn[.]net; script retrieval from hxxps://gsocket[.]io/y
- Staging and persistence paths: /dev/shm/.gs-0/, /tmp/.gsn_ora, /usr/bin/systemd-remount-d, /usr/bin/defunct and defunct.service
- SHA-256 d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa (gs-netcat, x86-64)
- SHA-256 f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5 (gs-netcat, AArch64)
- SHA-256 55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f (systemd-remount-d)
None of this required the attackers to build or host anything. When the tool is free and the infrastructure belongs to someone else, the server itself is the only reliable place left to catch them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.