GSocket Backdoors Outlive the Patch: Attackers Keep Hold of Hacked Linux Web Servers Through a Shared Relay Network — Detections Up 356% Since March

High · 2026-11-13 · By H.A

Microsoft reports attackers installing the open-source GSocket tool on compromised PHP, cPanel and Apache servers, using layered cron, systemd and shell persistence and an un-blockable relay network to keep access after the web flaw is fixed.

Overview

Microsoft threat intelligence researchers report that attackers who break into Linux web servers are installing GSocket to keep their access after the original flaw is patched. GSocket is a legitimate open-source tool that lets two machines talk through firewalls and NAT. Microsoft says devices with GSocket-related detections rose 356.2% between March and August 2026.

The main defensive lesson: on these hosts, patching the web application does not end the intrusion. GSocket persistence survives the fix. Its traffic runs over a shared public relay network, so there is no attacker-owned IP or domain to block.

The Campaign

GSocket connects two endpoints through the Global Socket Relay Network (GSRN) using a shared secret. Neither side needs an open inbound port. Attackers use it as a stealthy command-and-control (C2) channel.

Microsoft's telemetry describes where it is being used:

• 87.1% of attributable incidents involved web applications and hosting.
• 63.9% involved PHP web applications and cPanel hosting, and 24.3% involved Apache.
• The most affected sectors were education and research (30.7%) and technology and telecommunications (22.9%). Microsoft attributes this to large, decentralised web estates rather than deliberate targeting.

Not every intrusion went through every stage. Microsoft did not confirm working persistence or relay connections in every case.

Timeline

• March 2026: GSocket abuse via bash installers is already being documented publicly.
• March–August 2026: detections in Microsoft telemetry rise 356.2%, though not steadily month to month.
• 11 November 2026: Microsoft publishes its analysis, with hunting queries and indicators.

Tradecraft

• Initial access: remote code execution through vulnerable internet-facing web apps. In one observed case it was an encoded command run through a vulnerable PHP application. Microsoft did not name specific initial-access CVEs.
• Deployment: a curl | bash installer profiles the host and picks an x86-64 or AArch64 client. It stages the client in memory-backed paths such as /dev/shm/.gs-0/, then deletes its staging files.
• Secret handling: the installer generates a random shared secret. It is printed, written to a temp file, or sent to the operator through Telegram (GS_TG_TOKEN, GS_TG_CHATID), Discord or a webhook.
• Masquerading: binaries pose as kernel threads or system services, for example systemd-remount-d, or /usr/bin/defunct started with argv[0] set to [kaluad].
• Persistence: layered cron jobs, systemd units (defunct.service), shell startup files, watchdog processes and redundant copies. Killing one process is not enough.
• Privilege escalation: in a few incidents, attackers tried CVE-2026-43284 ("Dirty Frag") to go from the web-service account to root.
• Anti-forensics: history clearing and timestamp manipulation.

Indicators of Compromise

The relay network is shared, legitimate infrastructure. The domains below are tool-distribution endpoints, not attacker C2. Treat hits as leads that need context, not as proof of compromise.

• Domains: gsocket[.]io, cdn[.]gsocket[.]io, gsgg[.]b-cdn[.]net
• URLs: hxxps://gsocket[.]io/y, hxxps://gsocket[.]io/install.sh, hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64, hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64
• SHA-256 d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa — /dev/shm/.gs-0/gs-netcat_mini-linux-x86_64
• SHA-256 f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5 — /dev/shm/.gs-0/gs-netcat_mini-linux-aarch64
• SHA-256 55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f — /tmp/systemd-remount-d, /usr/bin/systemd-remount-d
• SHA-256 12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c — /tmp/.gsn_ora
• Files and units: /dev/shm/.gs-*, /tmp/.gsn_ora, /usr/bin/defunct, defunct.service

Microsoft Defender detects the client as HackTool:Linux/GsNetcat.A!MTB.

Detection

Hunt on the host for the staging paths, masquerading binaries and persistence:

ls -la /dev/shm/ /dev/shm/.gs-* 2>/dev/null
ls -la /tmp/systemd-remount-d /usr/bin/systemd-remount-d /usr/bin/defunct /tmp/.gsn_ora 2>/dev/null
systemctl list-units --all | grep -Ei "defunct|remount-d"
grep -RniE "gs-netcat|gsocket|GSOCKET_ARGS|defunct" /etc/cron* /var/spool/cron ~/.bashrc ~/.profile /etc/profile.d 2>/dev/null
ps -eo pid,ppid,user,args | grep -E "\[kaluad\]|gs-netcat|remount-d" | grep -v grep

In EDR, look for shells spawned by PHP or Java web processes, piped download-and-execute command lines, execution from hidden or world-writable directories, and new cron or systemd entries created by the web-server user. Alert on outbound connections from web servers to GSocket distribution hosts or the relay network.

Recommended Actions

• Clean the host, not just the bug. Remove the client, every persistence layer and the staged files. Then confirm relay traffic has stopped. If root was reached, rebuild.
• Keep web apps, CMS platforms and plugins patched. Remove unused components and lock down upload and admin paths.
• Apply deny-by-default egress filtering on web servers. Most have no reason to open arbitrary outbound sessions.
• Mount /tmp, /var/tmp and /dev/shm with noexec where feasible.
• Patch local privilege-escalation bugs such as CVE-2026-43284 quickly on internet-facing hosts.
• Rotate credentials and secrets stored on or used by any affected server.

Analyst Assessment

GSocket appeals to attackers for the same reasons admins like it: it is free, signed by nobody, needs no inbound port, and rides infrastructure that defenders cannot simply block. Its spread on shared hosting and university web estates follows the familiar pattern of opportunistic web exploitation followed by quiet, long-term access. Many teams close a web-app incident once the patch is applied. This research is a reminder to check what was installed before the patch, because the intruder may still have access.