Attackers are planting a legitimate remote access tool called GSocket on Linux servers so they can keep control even after the security hole they first used has been patched. Microsoft reported the trend on 11 November, saying detections of malicious GSocket activity rose 356.2% between March and August 2026.

GSocket is a free, open-source tool built for remote administration. Attackers have turned it into a quiet backdoor because it routes traffic through a shared public relay network, the Global Socket Relay Network, rather than through a server the attackers own. Both the compromised server and the attacker make outbound connections to the relay, so there is no attacker IP address or domain for defenders to block, and no inbound listener on the server to spot.

Web hosts are the main target

Microsoft's figures come from Microsoft Defender for Endpoint telemetry, so they describe systems running that product rather than every Linux server on the internet. Within the incidents Microsoft could attribute, web applications and hosting accounted for 87.1%. Inside that group, PHP web applications and cPanel hosting made up 63.9% of incidents, and Apache environments 24.3%.

Education and research organisations saw the largest share of the activity at 30.7%, followed by technology and telecommunications at 22.9%. Microsoft said this pattern probably reflects exposure, with internet-facing web servers offering the easiest way in, rather than deliberate targeting of particular sectors. The company stressed that several unrelated threat actors are using the same tool, rather than a single group.

Patching the first flaw does not remove it

The central warning in Microsoft's report is that fixing the vulnerability used for initial access does not end the intrusion. In the incidents Microsoft observed, attackers exploited an internet-facing web application, installed GSocket, and then kept access after administrators patched the original flaw. The attackers hid the tool by disguising its processes as legitimate Linux activity, including names resembling kernel threads, and kept it running with cron jobs, systemd services and shell startup files.

In some incidents, the attackers also tried to exploit CVE-2026-43284, a Linux kernel flaw known as Dirty Frag, to gain root privileges on the host. Microsoft described these as attempts, and did not say how often they succeeded. The flaw is a page-cache write bug in the kernel's IPsec receive path.

What defenders should check

Microsoft advised defenders not to treat patching the application as complete remediation. Instead, it said teams should look for GSocket deployment, persistence mechanisms, privilege escalation and outbound connections on affected hosts. Because the traffic leaves the network rather than arriving at it, inbound firewall rules do not catch it; egress filtering and monitoring of outbound connections are the controls Microsoft pointed to.

The practical message for anyone running a Linux web server is to check for unknown persistence as well as patching. A server that was compromised and then patched can still be under an attacker's control if a tool such as GSocket was left behind. Microsoft's full report, "The global socket: how threat actors are weaponizing GSocket for stealthy C2", was published on 11 November, and BleepingComputer reported the findings on 12 November.