GSocket Backdoors Outlive the Patch: Attackers Keep Hold of Hacked Linux Web Servers Through a Shared Relay Network — Detections Up 356% Since March

High · 2026-11-13 · By H.A

GSocket Backdoors Outlive the Patch: Attackers Keep Hold of Hacked Linux Web Servers Through a Shared Relay Network — Detections Up 356% Since March

Microsoft reports attackers installing the open-source GSocket tool on compromised PHP, cPanel and Apache servers, using layered cron, systemd and shell persistence and an un-blockable relay network to keep access after the web flaw is fixed.

Overview

Microsoft threat intelligence researchers report that attackers who break into Linux web servers are installing GSocket to keep their access after the original flaw is patched. GSocket is a legitimate open-source tool that lets two machines talk through firewalls and NAT. Microsoft says devices with GSocket-related detections rose 356.2% between March and August 2026.

The main defensive lesson: on these hosts, patching the web application does not end the intrusion. GSocket persistence survives the fix. Its traffic runs over a shared public relay network, so there is no attacker-owned IP or domain to block.

The Campaign

GSocket connects two endpoints through the Global Socket Relay Network (GSRN) using a shared secret. Neither side needs an open inbound port. Attackers use it as a stealthy command-and-control (C2) channel.

Microsoft's telemetry describes where it is being used:

Not every intrusion went through every stage. Microsoft did not confirm working persistence or relay connections in every case.

Timeline

Tradecraft

Indicators of Compromise

The relay network is shared, legitimate infrastructure. The domains below are tool-distribution endpoints, not attacker C2. Treat hits as leads that need context, not as proof of compromise.

Microsoft Defender detects the client as HackTool:Linux/GsNetcat.A!MTB.

Detection

Hunt on the host for the staging paths, masquerading binaries and persistence:

ls -la /dev/shm/ /dev/shm/.gs-* 2>/dev/null
ls -la /tmp/systemd-remount-d /usr/bin/systemd-remount-d /usr/bin/defunct /tmp/.gsn_ora 2>/dev/null
systemctl list-units --all | grep -Ei "defunct|remount-d"
grep -RniE "gs-netcat|gsocket|GSOCKET_ARGS|defunct" /etc/cron* /var/spool/cron ~/.bashrc ~/.profile /etc/profile.d 2>/dev/null
ps -eo pid,ppid,user,args | grep -E "\[kaluad\]|gs-netcat|remount-d" | grep -v grep

In EDR, look for shells spawned by PHP or Java web processes, piped download-and-execute command lines, execution from hidden or world-writable directories, and new cron or systemd entries created by the web-server user. Alert on outbound connections from web servers to GSocket distribution hosts or the relay network.

Recommended Actions

Analyst Assessment

GSocket appeals to attackers for the same reasons admins like it: it is free, signed by nobody, needs no inbound port, and rides infrastructure that defenders cannot simply block. Its spread on shared hosting and university web estates follows the familiar pattern of opportunistic web exploitation followed by quiet, long-term access. Many teams close a web-app incident once the patch is applied. This research is a reminder to check what was installed before the patch, because the intruder may still have access.

REEF SENTINEL