[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkiGTON7TxPHsdJZgUhHm5HJ7X7uckcjYFuC1htq-O04":3},{"article":4,"iocs":52,"watch_terms":57,"solutions":58,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"ed07892b-b59a-4092-811c-8b15adaccb46","Hackers plant GSocket on Linux servers for persistent access","hackers-plant-gsocket-on-linux-servers-for-persistent-access-5af37a","Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access. [...]","Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain persistent access on Linux servers, even after initial vulnerabilities are patched. Detections of malicious GSocket activity have increased significantly since March, primarily targeting web applications and hosting environments. Attackers disguise GSocket as kernel threads and use cron jobs, systemd services, and shell startup files for persistence, sometimes exploiting the 'Dirty Frag' Linux kernel flaw (CVE-2026-43284) for root privileges.","Hackers are using GSocket, a legitimate remote access tool, to maintain persistent access on Linux servers.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-plant-gsocket-on-linux-servers-for-persistent-access\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F03\u002F05\u002Fhand.jpg","2026-11-12T09:38:00+00:00","2026-11-12T10:00:15.31898+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"GSocket","technology",{"name":21,"type":22},"Linux","product",{"name":24,"type":22},"PHP",{"name":26,"type":22},"cPanel",{"name":28,"type":22},"Apache","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,45,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":29,"icon":31,"name":32,"slug":33},{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":55,"context":56},"cve","CVE-2026-43284","Linux kernel flaw exploited to gain root privileges",[21,24,26],{"controls":59,"vendors":147},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":119,"name":120,"problem":121,"products":122},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":164},"gsocket-abused-for-persistent-linux-server-access-via-cron-systemd-and-kernel-exploits","GSocket Abused for Persistent Linux Server Access via Cron, systemd, and Kernel Exploits","Attackers are leveraging GSocket, a legitimate open-source tool, to maintain persistent footholds on Linux servers even after the initial vulnerability is remediated — meaning patching alone is insufficient once an adversary has established persistence mechanisms. By disguising GSocket as kernel threads and embedding it in cron jobs, systemd services, and shell startup files, threat actors ensure their access survives reboots and routine security responses. The exploitation of CVE-2026-43284 ('Dirty Frag') to gain root privileges compounds the risk by granting attackers full system control. This incident highlights that effective defense requires both proactive vulnerability patching and continuous monitoring for unauthorized persistence artifacts, not just reactive patching of disclosed CVEs.",[159,160,161,162,163],"MITRE ATT&CK T1053.003: Scheduled Task\u002FJob: Cron","MITRE ATT&CK T1543.002: Create or Modify System Process: Systemd Service","CIS Control 10: Malware Defenses (v8)","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":165,"CIS Control 10: Malware Defenses (v8)":166,"MITRE ATT&CK T1053.003: Scheduled Task\u002FJob: Cron":167,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":168,"MITRE ATT&CK T1543.002: Create or Modify System Process: Systemd Service":169},"This article requires vulnerability handling and secure maintenance practices, directly applicable to the failure to patch CVE-2026-43284 that allowed attackers to escalate to root privileges.","CIS Control 10 requires organizations to deploy tools that detect and block unauthorized software execution, which would help identify GSocket masquerading as legitimate processes.","Attackers used cron jobs as a persistence mechanism on Linux servers, which is exactly the technique this ATT&CK entry describes and that defenders should monitor for.","SI-7 mandates integrity verification of software and system components, which — if applied to startup files and services — would detect unauthorized GSocket persistence artifacts.","Threat actors installed malicious systemd services to maintain persistent access, the precise behavior this technique documents and that detection controls should target."]