Microsoft has observed attackers using GSocket to retain access to compromised Linux servers after the vulnerabilities that enabled the initial intrusion were patched. Its November 11 research highlights why fixing an exposed application may leave an established foothold intact.
GSocket is an open-source remote access tool with legitimate administrative uses. In these intrusions, attackers abused its shared Global Socket Relay Network to carry encrypted command-and-control traffic. Both the operator and compromised server connect outward, so the server needs no inbound listener.
Microsoft found concealed processes and persistence mechanisms involving cron, systemd and shell startup files. Its analysis combines observations from multiple incidents; it does not establish that every technique succeeded in every case.
Defenders should investigate the host alongside patching the application: review unexpected processes, persistence entries and suspicious execution from writable directories, then verify that unauthorized relay connections have stopped. Outbound monitoring and appropriate egress restrictions remain relevant even when inbound firewall rules are restrictive.
