Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching

Microsoft has warned that attackers are using a free remote access tool called GSocket to stay inside Linux servers even after the original security hole is fixed.

Many admins treat a patch as the end of an incident, but this activity shows that patching alone may leave the attacker’s access untouched.

GSocket is an open source tool built for remote administration. Attackers have turned it into a quiet backdoor because it hides its traffic inside a shared public relay network.

Other researchers have also seen AI-generated scripts spreading GSocket in recent Linux intrusions, which shows how widely the tool is being reused.

Researchers from Microsoft identified the activity through Microsoft Defender for Endpoint data and described it in a new report published on November 11, 2026.

The report was written by Yash Gund, Sumith Maniath, and the wider Microsoft Security Research team. Microsoft noted that several unrelated threat actors have adopted the same tool, and that detections grew by 356.2% between March and August 2026, though the rise was uneven from month to month.

Microsoft Warns Hackers Are Using GSocket Backdoors

The attacks start with a flaw in an internet-facing web application. Once attackers can run commands through the web server, they use curl to download a script and run it with bash.

The script checks the host, picks a GSocket client that matches the system type, and saves it in a writable or memory-backed folder such as /dev/shm. That access normally lasts only until the bug is fixed or the service restarts, so attackers add a second way in.

GSocket solves this problem for them. Both the infected server and the attacker connect outward to the Global Socket Relay Network, which pairs the two sessions over an encrypted channel.

The server needs no open port or public IP address, and inbound firewall rules never see the traffic. Because the tool runs on its own, separate from the hacked application, patching the original bug does not remove it.

Connections are matched using a shared secret rather than an IP address or domain. The install script creates a random secret, and the attacker can read it from the console, from a temporary file, or through Telegram, Discord, or a webhook.

With that secret, the attacker can return at any time from any compatible GSocket client. Blocking an IP address or domain is therefore unlikely to cut off access, because there is no attacker-owned server to block.

The attackers also work to avoid being noticed. Microsoft saw them rename the process to look like a kernel thread, keep persistence through cron jobs, systemd services, shell profiles, and watchdogs, and delete the staging files afterward. Some used the same trick seen in fileless PHP web shells on Linux: hiding in places that look normal during a quick check.

Who Is Being Hit and How to Respond

Web applications and hosting systems made up 87.1% of the incidents Microsoft could attribute. PHP applications and cPanel hosting accounted for 63.9% of those, and Apache for 24.3%.

Education and research organizations were the largest share of affected groups at 30.7%, followed by technology and telecommunications at 22.9%.

Microsoft says this likely reflects exposure rather than deliberate targeting, since universities often run large web estates outside central IT that are hard to track and patch.

Admins who have followed recent cPanel vulnerabilities exposing hosting servers will recognize this kind of environment. In a few cases, the attackers also tried to gain root access by exploiting CVE-2026-43284, a Linux kernel bug known as Dirty Frag.

Our earlier coverage of the Dirty Frag Linux kernel flaw explains why kernel patching matters on internet-facing servers. Microsoft’s main advice is to fix the host as well as the bug.

Admins should remove the GSocket client, its persistence entries, and any staged files, then confirm that outbound connections to the relay have stopped.

Other steps include setting deny-by-default egress rules, mounting temporary and memory-backed folders as non-executable, and reviewing cron entries, systemd units, and shell startup files. Microsoft also recommends running Defender for Endpoint on Linux with real-time protection turned on.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching appeared first on Cyber Security News.