GSocket on compromised Linux web servers: Microsoft sees several unrelated actors install the open-source relay client after exploiting an internet-facing web application, so access outlives the patch; no inbound listener, no attacker-hosted infrastructure

Microsoft observed several unrelated threat actors deploy GSocket, an open-source remote access tool, on Linux servers after exploiting an internet-facing web application, and says it kept access after the exploited vulnerabilities were remediated (Microsoft, 2026-11-11). The chain starts with command execution as a child of the web server or application runtime, where curl fetches an installation script that bash runs; the script profiles the host, picks a client matching the architecture, stages it as a hidden, executable file in a writable or memory-backed path such as /dev/shm and opens encrypted outbound command and control through the Global Socket Relay Network (Microsoft, 2026-11-11). The client is then disguised with kernel-thread-like process names (bash exec -a), persisted through cron, systemd units, shell profiles, watchdogs and redundant copies, and the staging files are removed (Microsoft, 2026-11-11). In a few incidents the actors afterwards attempted the Linux kernel flaw CVE-2026-43284, known as Dirty Frag, to reach root; Microsoft gives no success statement and no affected or fixed versions (Microsoft, 2026-11-11).

Both the compromised host and the operator connect outbound to the public relay, so the host needs no inbound listener, inbound firewall rules do not see the traffic and a shared secret, not an address, pairs the endpoints, which lets the operator reconnect later from any compatible client; Microsoft therefore says that blocking an address or domain is unlikely to cut off access, while egress filtering and outbound monitoring can see it (Microsoft, 2026-11-11). Microsoft's telemetry is concentrated on web applications and hosting; education and research and technology and telecommunications were the largest shares of affected organisations, which Microsoft says reflect exposure more likely than deliberate sector selection (Microsoft, 2026-11-11).

Triage: Microsoft notes that the same relay model also serves legitimate remote administration, and says a match must be judged on process ancestry, execution context, persistence changes and related network activity; a client started from a web-service process tree, from a writable or memory-backed path and under a kernel-thread-like name is the pattern it describes (Microsoft, 2026-11-11).