Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching

Patching a vulnerability is not the same as fully remediating a compromise. In this campaign, attackers exploited web application flaws to install GSocket, an open-source relay tool, before patches were applied — and the backdoor persisted even after the underlying flaw was fixed. Because GSocket tunnels traffic through a public relay network without requiring open ports or public IPs, it evades firewall-based blocking and blends into normal outbound traffic. This highlights a critical gap in many incident response procedures: teams close the initial vulnerability but fail to verify whether the system was already compromised and cleaned. The lesson is that patching must be paired with thorough post-exploitation forensics and persistent egress traffic monitoring.