Attackers are using GSocket to maintain access to compromised Linux servers, even after the original vulnerability has been patched, Microsoft says. Its telemetry shows GSocket detections rose 356.2% between March and August 2026, with web applications and hosting accounting for 87.1% of attributable incidents in the analysed data.
Watch Desk analysis
What happened
Microsoft describes GSocket as an open-source remote access tool that routes connections through a shared public relay. Both the compromised server and the operator connect outbound, so there may be no attacker-owned IP address or domain for defenders to block. Microsoft says attackers have used it for command and control, persistence and, in some incidents, attempted privilege escalation.
The activity Microsoft analysed often began with an internet-facing web application compromise. Attackers deployed the tool, disguised its process and added persistence mechanisms that could survive a reboot. The company says the increase in detections was not consistent month to month, and its figures describe its own telemetry, not a count of every affected Linux server.
Why it matters
Patching the application that let attackers in may close the original door without removing the foothold they have already installed. Microsoft advises investigating the host itself: look for GSocket, staged files and persistence in places such as cron jobs, systemd units and shell startup files, then check whether outbound connections to the relay have stopped.
The shared-relay design also complicates familiar block-the-bad-IP responses. Microsoft recommends restricting unnecessary outbound traffic and monitoring for unusual activity from web-service processes. For operators, the important distinction is simple: fixing the entry point and evicting an intruder are separate jobs.
Our read
This is a useful warning because it names the gap between “the vulnerable app is patched” and “the server is clean”. Microsoft’s figures come from its own security telemetry, but the practical lesson is clear: after a web-server compromise, patching should start the investigation, not end it.
What to watch
- Whether defenders find GSocket or related persistence after patching exposed applications.
- Whether outbound monitoring catches connections that ordinary inbound firewall rules will not.
- Whether Microsoft reports further changes in GSocket detections or the affected environments.
Discussion spark: After patching an exposed server, should organisations treat it as compromised until they have checked for persistence and outbound relay connections?
Sources and evidence
- The global socket: how threat actors are weaponizing GSocket for stealthy C2 – Microsoft (11 November 2026, 19:49 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.