Microsoft Finds Hackers Using GSocket to Hide Linux Backdoors as Legitimate System Processes

Attackers deployed GSocket on compromised Linux servers, disguised its processes as legitimate system components, and retained access after administrators patched the original vulnerabilities.

In its November 11 report, Microsoft described unrelated threat actors abusing the open source remote access tool rather than maintaining dedicated command-and-control infrastructure.

Defender for Endpoint telemetry recorded a 356.2% increase in devices with GSocket-related detections between March and August 2026, although growth fluctuated monthly.

Web applications and hosting environments represented 87.1% of attributable incidents. Within that category, PHP applications and cPanel hosting accounted for 63.9%, while Apache represented 24.3%.

Education and research organizations comprised 30.7% of affected organizations, followed by technology and telecommunications at 22.9%.

Microsoft cautioned that exposure, rather than deliberate sector targeting, likely explains this distribution.

Observed attack chains began by exploiting internet-facing applications. Attackers used curl to retrieve and execute deployment scripts, which profiled the compromised host, selected an architecture-compatible GSocket client, and staged payloads in writable or memory-backed locations, including /dev/shm.

The tooling then established encrypted outbound communications through the Global Socket Relay Network. To conceal execution, attackers adopted kernel-thread-like names and plausible service identities.

Microsoft documented a GsNetcat binary running as systemd-remount-d and another execution context presenting the name [kaluad].

Microsoft observed that , the activity demonstrates how an initial web application compromise can become a persistent backdoor operating independently of the exploited service.

GSocket-Based Linux Attacks

Persistence extended across cron jobs, systemd units, shell startup files, watchdogs, and redundant payload copies. Attackers also removed staging artifacts, complicating reconstruction.

These overlapping mechanisms mean terminating one suspicious process does not necessarily eliminate access. Not every intrusion included every stage.

In a small number of incidents, attackers attempted to exploit CVE-2026-43284, associated with Dirty Frag, to escalate from a web-service account to root.

Microsoft’s separate Dirty Frag analysis describes post-compromise abuse of vulnerable Linux kernel networking and memory-fragment handling components.

Unlike conventional reverse shells, GSocket does not require an attacker-controlled destination embedded in its payload.

The compromised server and operator independently establish outbound connections to a public relay, which pairs them using authentication material derived from a shared secret and brokers an end-to-end encrypted session.

The deployment script typically generates that secret during installation. Operators can retrieve it from console output, temporary files, or supported notification channels such as Telegram , Discord, and webhooks.

Possession of the secret enables reconnection without knowing the victim’s address or hostname.

This architecture avoids inbound listeners and works across network address translation. There is no dedicated attacker-owned domain or IP address to block, but defenders can still restrict access to the relay infrastructure through outbound controls.

Microsoft recommends investigating both the exploited application and the underlying host. Responders should remove GSocket binaries, staged files, and persistence mechanisms, then verify that relay connections have stopped.

Application updates alone leave independently installed backdoors intact.

Organizations should constrain egress, audit cron and systemd configurations, inspect shell profiles, and monitor unusual web-service child processes.

Where feasible, temporary directories should prohibit execution. Kernel patching remains essential against subsequent privilege escalation, while Defender for Endpoint on Linux should retain real-time, cloud-delivered, and behavioral protection.

Indicators of compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

State- Hackers Deploy Up to 8 AI Agents to Target Taiwanese Government Systems

PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability With CVSS 9.8 Score

Palo Alto Networks Patches PAN-OS Vulnerability Allowing Remote Code Execution With Root Privileges

Qilin Ransomware Gang Leader Allegedly Identified as 36-Year-Old Russian Man

12 Adversarial Exposure Validation Tools: The 2026 Buyer’s Verdict Guide

Shipping Giant Maersk Confirms Data Breach Following Unauthorized Access to IT Systems