Threat Actors Exploit GSocket for Persistent Access on Linux Servers

• •GSocket is being used for persistent access on compromised Linux servers.
• •There was a 356.2% increase in GSocket detections from March to August 2026.
• •Attackers exploit the CVE-2026-43284 vulnerability to gain root privileges.

Microsoft has reported that multiple threat actors are using GSocket, an open-source remote access tool, to maintain access to compromised Linux servers even after vulnerabilities have been patched. This activity has surged since March 2026, with a 356.2% increase in detections between March and August. GSocket allows attackers to bypass traditional security measures by routing traffic through the Global Socket Relay Network, making it difficult for defenders to block malicious connections. The compromised servers do not require inbound listeners, which enhances stealth. Affected systems primarily include web applications and hosting environments, particularly in the education, technology, and government sectors. The CVE-2026-43284 vulnerability, which allows for privilege escalation, has been exploited in some cases. Microsoft recommends that system administrators remove GSocket and audit their systems for any unauthorized changes.