[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRfD-e3bVR1pkT4Lh6OoQOM1O5DflK6BE1n7VCCF1c34":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e40906b4-9022-4094-9c2e-244c50b7a75f","The global socket: how threat actors are weaponizing GSocket for stealthy C2","the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2-f3f53e","Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity. The post The global socket: how threat actors are weaponizing GSocket for stealthy C2 appeared first on Microsoft Security Blog.","Threat actors are deploying GSocket, an open-source remote access tool, on compromised Linux servers to maintain persistent access even after the initial vulnerabilities are remediated. GSocket leverages a public relay network, eliminating the need for threat actors to host their own infrastructure, and its deployment script includes evasion and persistence capabilities. Microsoft Defender for Endpoint telemetry indicates a significant increase in GSocket-related detections, primarily targeting web applications and hosting environments.","Threat actors are using GSocket on Linux servers to maintain access after vulnerabilities are patched.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F11\u002Fglobal-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMS_Actional-Insights_Cybercrime.jpg","2026-11-11T19:49:57+00:00","2026-11-11T21:00:24.112408+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Linux","technology",{"name":24,"type":22},"web applications",{"name":26,"type":22},"hosting environments",{"name":28,"type":22},"PHP",{"name":30,"type":22},"cPanel","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":35,"value":51,"context":52},"GSocket","Open source remote access tool used by threat actors for C2",[18],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":86,"name":87,"problem":88,"products":89},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":115,"name":116,"problem":117,"products":118},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",[144],{"slug":145,"name":18,"logo_path":146,"roles":147},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":159},"gsocket-weaponized-for-persistent-c2-after-vulnerability-remediation","GSocket Weaponized for Persistent C2 After Vulnerability Remediation","Threat actors are exploiting web application vulnerabilities to deploy GSocket, an open-source tool that tunnels command-and-control traffic through a public relay network, allowing attackers to maintain persistent access even after the original vulnerability is patched. This highlights a critical gap in incident response: remediating the initial vulnerability without thoroughly investigating and evicting any implants left behind gives attackers a lasting foothold. Because GSocket uses a legitimate public relay rather than attacker-owned infrastructure, traditional network-based detection of suspicious C2 domains or IPs is largely ineffective. Organizations that lack robust endpoint telemetry and behavioral monitoring on Linux servers will likely miss this persistence mechanism entirely, leaving themselves exposed long after they believe the incident is resolved.",[154,155,156,157,158],"MITRE ATT&CK T1572: Protocol Tunneling","MITRE ATT&CK T1053: Scheduled Task\u002FJob","NIST SP 800-53 IR-4: Incident Handling","CIS Control 13: Network Monitoring and Defense","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":160,"MITRE ATT&CK T1053: Scheduled Task\u002FJob":161,"MITRE ATT&CK T1572: Protocol Tunneling":162,"NIST SP 800-53 IR-4: Incident Handling":163,"CIS Control 13: Network Monitoring and Defense":164},"This point mandates effective incident handling procedures, including full eradication of attacker access, which would prevent the scenario where GSocket persistence survives after the initial vulnerability is remediated.","GSocket's deployment script establishes persistence via scheduled jobs or similar mechanisms, which this technique covers and which defenders should hunt for during post-incident review.","GSocket tunnels C2 traffic through a public relay network, which is precisely the technique this ATT&CK entry describes and for which detection guidance is provided.","This control requires organizations to contain, eradicate, and recover from incidents fully, which would have mandated searching for and removing GSocket implants rather than simply patching the initial vulnerability.","This control requires monitoring and analysis of network traffic to detect anomalous outbound connections, which would help surface GSocket's relay-based C2 communications on Linux servers."]