In a report published on 12 November 2026, researchers detailed how threat actors are actively abusing a legitimate open-source remote access tool to maintain persistent access to compromised Linux servers. According to Microsoft Defender telemetry, detections related to the tool surged significantly, recording a 356.2 percent increase between March and August. The malicious activity highlights a growing trend of attackers leveraging dual-use administrative utilities to evade detection while maintaining long-term footholds on enterprise networks.
The technique centres around the abuse of GSocket, a legitimate open-source utility designed for secure remote connectivity. Attackers employ the software to bypass traditional perimeter firewalls and establish reliable communication channels without requiring inbound listeners or dedicated command and control servers. By having both endpoints initiate outbound connections, GSocket routes traffic seamlessly through the Global Socket Relay Network, making traditional network perimeter monitoring significantly more challenging for defenders.
Technical analysis shows that attackers typically deploy the tool following an initial system compromise, often disguising GSocket processes as standard kernel threads to avoid administrative scrutiny. To ensure persistence across reboots, threat actors utilise systemd services, cron jobs, and shell startup files. Furthermore, observed attacks indicate that adversaries sometimes attempt to exploit the Dirty Frag vulnerability, tracked as CVE-2026-43284, in order to escalate their privileges to root on the vulnerable underlying Linux operating system.
The telemetry data reveals a distinct focus on web applications and hosting environments, which accounted for the vast majority of all detected incidents. Specifically, PHP web applications and cPanel installations made up more than half of the targeted instances, while Apache web servers accounted for a smaller yet substantial portion of the detections. Primary industry targets identified in the campaign include the education and research sector, followed closely by technology and communications companies, manufacturing organisations, and various government entities.
The ability of threat actors to blend malicious remote access mechanisms with legitimate administrative utilities poses a severe challenge to system administrators and security operations teams. Because the tool relies entirely on outbound connections through a public relay network, standard firewall rules often fail to flag the malicious traffic. This tactic allows attackers to retain access even after initial vulnerabilities have been patched, underscoring the critical need for comprehensive endpoint visibility and behavioral monitoring across all hosting environments.
Security teams managing Linux infrastructure should immediately audit their systems for rogue cron jobs, unauthorised systemd services, and unexpected modifications to shell startup files. Organisations must remove GSocket and any associated files from potentially impacted servers while verifying that outbound connections to the relay network have ceased. Implementing strict egress filtering, monitoring outbound network traffic, and ensuring operating systems are patched against the Dirty Frag vulnerability will help mitigate these persistent threats.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
