Introduction
GSocket, a legitimate open-source remote access tool, has become a popular choice for threat actors to maintain persistent access to Linux servers. Since March, detections of malicious GSocket activity have increased, especially in attacks targeting web applications and hosting environments. This article delves into the tactics, targets, and mitigation strategies for this evolving threat.
GSocket Activity Overview
Since March, detections of malicious GSocket activity have increased, particularly in attacks targeting web applications and hosting environments. GSocket allows attackers to reach systems behind firewalls or NAT by intercepting network connections and routing traffic through the Global Socket Relay Network. Both endpoints initiate outbound connections to the relay, which matches them and brokers an end-to-end encrypted session, making it more difficult for defenders to disrupt attacks using IP- or domain-based access control lists.
GSocket Activity Trends
According to Microsoft Defender for Endpoint telemetry, GSocket-related detections increased by 356.2% between March and August. Microsoft explains that both the compromised server and the attacker connect outbound, making the attack stealthier. The compromised host and the operator both connect outbound to the relay, which bridges the two sessions. The host needs no inbound listener or public IP address, and network address translation does not prevent the connection.
GSocket Attack Tactics
The compromised host and the attacker connect outbound to the relay, which bridges the two sessions. The host needs no inbound listener or public IP address, and network address translation does not prevent the connection. The same model also removes the need for attackers to use a dedicated command-control (C2) server. Microsoft says inbound firewall rules don’t catch the malicious traffic, although egress filtering and outbound monitoring can. Of the detected incidents, 87.1% related to web applications and hosting. PHP web apps and cPanel hosting accounted for 63.9%, and Apache accounted for 24.3%.
GSocket Attack Targets
The researchers observed attackers disguising GSocket as kernel threads and using cron jobs, systemd services, and shell startup files for persistence purposes. In some cases, the attackers attempted to exploit the “Dirty Frag” Linux kernel flaw (CVE-2026-43284) to gain root privileges on the host. Most targets of GSocket activity are in the education and research sector, followed by technology and communications, manufacturing, and government entities.
GSocket Mitigation Strategies
Microsoft recommends that system administrators remove GSocket and associated files from potentially impacted servers and verify that outbound connections to its relay network have stopped. They also advise restricting outbound traffic to predetermined destinations and auditing cron jobs, systemd services, and shell startup files for rogue additions. Generally, keeping the OS and applications up to date, including patching for CVE-2026-43284, is a strong measure against this and other attacks.
GSocket and Remote Desktop Software
While GSocket is a legitimate remote access tool, it has been employed in remote access attacks, mostly via social engineering. This raises questions about the security of remote desktop software like Rustdesk. Installing and putting a strong password on access with tools like Rustdesk can prevent exploitation, but it is not a foolproof solution. System administrators and organizations should continue to monitor and update their systems to protect against similar threats.
Conclusion
The use of GSocket by threat actors to maintain persistent access to Linux servers is a growing concern. By understanding the tactics, targets, and mitigation strategies, organizations can better protect themselves against this evolving threat. Additionally, the use of remote desktop software like Rustdesk should be approached with caution and regular security checks to ensure its security and compliance with policies.
Comments