GSocket C2 Abuse: Microsoft Warns of Stealthy Persistence

Introduction

Microsoft is warning defenders about growing abuse of GSocket, an open source remote access tool being used as stealthy command-and-control (C2) on compromised Linux servers. The key risk for IT and security teams is that patching the exploited web application may not fully remove attacker access if GSocket has already been deployed for persistence.

What’s new

Microsoft Security Research says multiple unrelated threat actors are using GSocket after exploiting internet-facing applications, especially in web hosting environments.

Key findings

• Persistent access after remediation: Attackers used GSocket to keep access even after the original remote code execution vulnerability was fixed.
• No attacker-owned C2 to block: GSocket uses the public Global Socket Relay Network, so defenders often won’t find a dedicated malicious IP address or domain.
• Outbound-only communications: Both the compromised host and the operator connect outward to the relay, helping the traffic bypass controls focused on inbound connections.
• Built-in evasion and persistence: Attackers disguised processes with kernel-thread-like names and used cron, systemd, shell profiles, watchdogs, and redundant copies to survive reboots.
• Linux web servers most affected: Microsoft telemetry showed a 356.2% increase in GSocket-related detections from March to August 2026, with incidents concentrated in web applications and hosting. PHP applications, cPanel hosting, and Apache were heavily represented.

Why this matters for administrators

This research changes the response playbook for Linux web-server compromises. If a vulnerable application was exploited, simply patching and restarting services may leave a hidden backdoor in place.

Security and infrastructure teams should assume that:

• the web server process may have been used to download and launch tooling with curl
• binaries may be staged in writable or memory-backed paths such as /dev/shm
• persistence may exist outside the application itself
• outbound encrypted traffic may be the only visible network indicator

Microsoft also noted some attackers attempted privilege escalation using CVE-2026-43284, also known as Dirty Frag, after initial access.

Recommended next steps

• Investigate compromised Linux hosts for GSocket binaries, renamed processes, cron jobs, systemd services, and shell profile changes.
• Review outbound connections to relay infrastructure rather than relying only on inbound firewall rules.
• Hunt for suspicious use of curl, temporary file staging, and execution from memory-backed directories.
• Validate that incident response includes persistence and privilege escalation checks, not just application patching.
• Use Microsoft Defender for Endpoint and other EDR tools to identify related detections and suspicious Linux activity.

Bottom line

Microsoft’s findings show how a single web application RCE can quickly become long-term Linux persistence. For defenders, the priority is clear: treat application remediation as only the first step, and follow with host-level hunting, persistence checks, and egress-focused monitoring.