Hackers disguise GSocket backdoors on Linux servers as system processes, Microsoft warns

Several groups of attackers are using GSocket, an open-source tool, to keep covert access to compromised Linux servers, Microsoft security researchers said in a report published on 11 November. The tool lets them get back in even after the vulnerability they used to break in has been patched.

How the attacks work

According to Microsoft, the attackers first exploit vulnerable web applications to run commands on a server. They then download a script that profiles the system, picks a matching GSocket client and places it in memory-backed folders such as /dev/shm.

To avoid attention, the process is given a name that looks like a Linux kernel thread or a systemd service. Access is secured several times over: cron jobs, systemd services, entries in shell profiles and backup copies. The attackers then delete their staging files and alter file timestamps. In a few cases they tried to gain root privileges through the CVE-2026-43284 vulnerability.

Why it is hard to spot

GSocket needs no command server of its own: both the compromised machine and the attacker connect out to the public Global Socket relay network, so a firewall that watches incoming connections does not see the traffic. GSocket-related detections in Microsoft Defender for Endpoint rose 356.2% between March and August.

Microsoft did not name a specific group. Web applications and hosting made up 87.1% of the incidents it could attribute, with PHP applications and cPanel accounting for 63.9%. By number of affected organisations, education and research was hit hardest (30.7%), followed by technology and telecommunications (22.9%).

What Microsoft recommends

Microsoft advises cleaning the whole host rather than just patching the application: remove the GSocket client, its start-up entries and staging files, and confirm that connections to the relay network have stopped. It recommends denying outbound traffic by default, mounting temporary and memory-backed folders without execute permission, regularly checking cron, systemd and shell start-up files, and keeping web applications and content management systems up to date.