Microsoft: attackers keep a back door into hacked Linux web servers with GSocket

Patching the hole an attacker used to get into a server doesn’t always get them out. In a report published on November 11, 2026, Microsoft describes multiple incidents in which attackers broke into Linux web servers and installed GSocket, a free, open-source remote-access tool, so they could come back whenever they liked, even after the original flaw was fixed. If you run websites, hosting accounts or other internet-facing Linux servers, here’s what Microsoft found and what to check.

What GSocket is, and why attackers like it

GSocket is a legitimate tool built by The Hacker’s Choice for connecting to machines behind firewalls. Both ends connect out to a shared public relay, the Global Socket Relay Network, which pairs them over an encrypted channel. A machine only needs a shared secret to be reached, not a public IP address or an open port.

Microsoft says that design solves several problems for attackers at once:

• Nothing to block. Traffic goes through a public relay, so there’s no attacker-owned IP address or domain to put on a blocklist. Organisations can still block the relay itself.
• Outbound only. The hacked server dials out, so inbound firewall rules don’t see it. Egress filtering and outbound monitoring can.
• Built-in hiding. The install script can rename the process, stage files in memory-backed folders and set up persistence that survives a reboot.

How the attacks unfold

Microsoft says the intrusions followed a similar sequence, though not every step happened every time:

1. Break in through a web application. Attackers exploited internet-facing apps to run commands as the web server, then used curl to download and run a script from GSocket’s own site.
2. Install and hide. The script picks the right GSocket build, stages it in places like /dev/shm, and disguises it with names that look like kernel threads or system services, such as systemd-remount-d or defunct.
3. Stay. Persistence through cron jobs, systemd services, shell profiles and watchdogs, often several at once, then the install files are deleted.
4. Escalate. In a few cases, attackers tried CVE-2026-43284, a recent Linux kernel flaw known as Dirty Frag, to get root.

The secret that lets the attacker reconnect can be sent to them through Telegram, Discord or a webhook, so they can return later from anywhere without knowing the server’s address.

Who is being hit

Microsoft Defender for Endpoint telemetry shows devices with GSocket-related detections rose 356.2% from March to August 2026, though not steadily month to month. Web applications and hosting made up 87.1% of the incidents Microsoft could attribute. Within that group, PHP web apps and cPanel hosting were 63.9% and Apache 24.3%. By sector, education and research had the largest share of affected organisations (30.7%), then technology and telecommunications (22.9%). Microsoft says that likely reflects exposure, such as universities’ large, scattered web estates, rather than deliberate targeting. It hasn’t tied the activity to a single group and says multiple unrelated attackers have adopted the tool.

What you can do

If you look after Linux web servers or hosting accounts:

1. Don’t stop at the patch. After fixing a web app flaw, check the server for GSocket (gs-netcat or gsocket processes or files), unfamiliar cron entries and systemd services, and changes to shell startup files. Remove all of them, then confirm outbound connections to the relay have stopped.
2. Look for hidden files in /dev/shm and /tmp, such as a .gs-0 folder or .gsn_ora, and for system-sounding binaries in /usr/bin you didn’t install.
3. Restrict outbound traffic. Allow only the destinations your servers need, and alert on connections to gsocket.io and the relay network.
4. Mount /dev/shm and /tmp as non-executable where you can.
5. Patch kernel privilege escalation bugs on internet-facing servers, not just the web app.
6. Keep web apps, CMS plugins and hosting panels up to date, and remove ones you no longer use.

If you just run a small site on shared hosting, ask your host whether it monitors for tools like GSocket, and keep your CMS and plugins updated.

How Frame helps

This is about compromised servers, not a list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t monitor servers.

Related coverage

• Huntress says attackers are using compromised ScreenConnect setups to reach MSP customers: another case of attackers keeping access through a legitimate remote-access tool.
• Attackers go after Qlik Sense servers and stage exploits for ActiveMQ and Veeam: a separate campaign this week that also relied on old, unpatched server flaws.

Sources

• Microsoft Security, The global socket: how threat actors are weaponizing GSocket for stealthy C2, November 11, 2026
• The Hacker’s Choice, GSocket (project page)