Microsoft warns attackers use GSocket relay tool to retain access to Linux servers

Microsoft has detailed new activity around GSocket, an open-source remote access tool observed on compromised Linux servers, used by threat actors to maintain access after initial vulnerabilities are remediated. Once deployed, GSocket runs a client on the victim host and communicates with the Global Socket Relay Network (GSRN), a shared public relay that brokers end-to-end encrypted sessions between the host and the operator.

The article notes that there is no threat actor-owned IP address or domain to block, and that patching the original web application vulnerability does not remove the relay client or its persistence. Defender for Endpoint telemetry shows growing activity in 2026, with most detections tied to web applications and hosting environments, particularly PHP-based web apps and Apache servers.

The observed attack chains start with exploitation of internet-facing applications, followed by host profiling, transfer and concealment of the relay tooling, and then the use of the resulting channel for command and control. In some cases, threat actors added persistence and attempted privilege escalation, including an attempted exploit of CVE-2026-43284 (Dirty Frag) to reach root privileges.

GSocket’s deployment can rename processes, stage in memory-backed directories, and install persistence that survives reboots, using a shared relay to connect outbound from the compromised host. MITRE techniques observed include Exploit Public-Facing Application, Unix shell execution, cron-based persistence, systemd service creation, masquerading with kernel-thread-like names, and hidden files/directories.

Indicators of compromise include domains and URLs such as gsocket[.]io and gsgg.b-cdn[.]net, specific hashes for the GSocket payloads, and staging paths like /dev/shm/.gs-0. Defences focus on patching and hardening the host and applications, restricting outbound traffic, auditing persistence surfaces, and enabling Defender for Endpoint on Linux.