Microsoft reports threat actors using GSocket for persistent Linux C2

What happened

According to a Microsoft Security Blog post dated 2026-11-11, Microsoft says it observed multiple incidents in which threat actors deployed GSocket, an open source remote access tool, on compromised Linux servers. Microsoft reports that the actors used it to keep access even after the vulnerabilities used for initial compromise were remediated. Microsoft Security

Microsoft describes the following behaviour, based on its own telemetry and analysis (this is a single-source report; no independent confirmation is available in the material reviewed):

• Deployment: Microsoft says actors exploited internet-facing web applications, used curl to download and run a remote script, and staged a GSocket client in writable or memory-backed paths such as /dev/shm. Microsoft Security
• No actor-owned C2 address: Microsoft says traffic passes through the Global Socket Relay Network, a public relay service, so there is no actor-owned IP address or domain to block. Both the host and the operator connect outbound, and a shared secret identifies the endpoints. Microsoft Security
• Evasion and persistence: Microsoft says the process was disguised with kernel-thread-like names and persisted through cron, systemd, shell profiles, watchdogs and redundant copies, with staging files then removed. Microsoft Security
• Privilege escalation: Microsoft says that in a few observed incidents, actors attempted to exploit CVE-2026-43284, a Linux kernel vulnerability it also calls Dirty Frag, to reach root. Microsoft Security
• Telemetry figures: Microsoft reports that from March through August 2026, devices with GSocket-related detections in Microsoft Defender for Endpoint increased 356.2%, though not consistently month to month. It says web applications and hosting made up 87.1% of attributable incidents, with PHP web applications and cPanel hosting at 63.9% and Apache at 24.3% within that group. Education and research was the largest share of affected organizations (30.7%), followed by technology and telecommunications (22.9%). Microsoft Security

Microsoft states these sector figures do not show that actors chose those sectors deliberately, and suggests exposure is the more likely factor.

Not confirmed in the source material reviewed: the names of the actors, the specific web application vulnerabilities used for initial access, and the total number of affected organizations. The copy of the post available to us was truncated, so later mitigation text may not be fully reflected here.

Am I affected?

Based on Microsoft’s report, the activity centres on Linux servers running internet-facing web applications and hosting stacks, mainly PHP applications, cPanel and Apache. Microsoft Security

You may be affected if:

• A Linux web server of yours was compromised through a web application flaw, even if that flaw has since been patched. Microsoft says patching does not remove the relay client or its persistence.
• You find unexpected processes with kernel-thread-like names, unusual cron entries, systemd units or shell startup changes, or executables in /dev/shm or other hidden or world-writable paths.
• You see outbound connections from servers to the GSocket relay network.

Whether a given host is compromised is not something the source lets us determine; this is a hunting lead, not proof of compromise.

What to do now

1. Treat application patching as only part of remediation on any previously compromised Linux server. Microsoft says to investigate and remove the GSocket client, its persistence and staged files, then verify that outbound connections to the relay have stopped. Microsoft Security
2. Audit persistence surfaces: cron entries, systemd units with plausible service names, and shell startup files. Microsoft notes persistence is often layered across several mechanisms.
3. Apply deny-by-default egress rules, allow only required destinations, and monitor outbound connections to relay infrastructure. Microsoft notes inbound firewall rules do not see this traffic, while egress filtering and outbound monitoring can.
4. Where feasible, mount temporary and memory-backed directories as non-executable, and alert on execution from hidden or world-writable paths.
5. Keep web applications, CMS platforms, plugins and application servers current, remove unused components, and restrict file-upload and administrative paths.
6. Check whether your kernels are exposed to CVE-2026-43284. Fixed kernel versions are not confirmed in the material reviewed, so consult your distribution’s advisory.

Sources

• Microsoft Security: The global socket: how threat actors are weaponizing GSocket for stealthy C2
• NVD: CVE-2026-43284