[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVIjG49wPTExgBrsuTDPVci93_vkSzT61363RiZ4w1SY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"eb20874d-3c04-4648-9874-da6fed1e583a","gsocket-weaponized-for-persistent-c2-after-vulnerability-remediation","e40906b4-9022-4094-9c2e-244c50b7a75f","GSocket Weaponized for Persistent C2 After Vulnerability Remediation","Threat actors are exploiting web application vulnerabilities to deploy GSocket, an open-source tool that tunnels command-and-control traffic through a public relay network, allowing attackers to maintain persistent access even after the original vulnerability is patched. This highlights a critical gap in incident response: remediating the initial vulnerability without thoroughly investigating and evicting any implants left behind gives attackers a lasting foothold. Because GSocket uses a legitimate public relay rather than attacker-owned infrastructure, traditional network-based detection of suspicious C2 domains or IPs is largely ineffective. Organizations that lack robust endpoint telemetry and behavioral monitoring on Linux servers will likely miss this persistence mechanism entirely, leaving themselves exposed long after they believe the incident is resolved.","**Immediate actions:**\n- Conduct full forensic triage of any compromised Linux server—not just patch the initial vulnerability—to identify and remove any deployed persistence mechanisms such as GSocket.\n- Deploy endpoint detection and response (EDR) tooling capable of behavioral analysis on Linux servers to surface anomalous processes and network tunneling activity.\n\n**Long-term improvements:**\n- Establish a formal incident response playbook that mandates post-remediation compromise assessment, including checks for new user accounts, cron jobs, and installed tools.\n- Harden web-facing Linux servers by enforcing application allowlisting to prevent unauthorized binaries like GSocket from executing.\n- Restrict outbound network connections from servers to approved destinations using egress filtering to limit the effectiveness of relay-based C2 channels.\n\n**Detection measures:**\n- Centralize and actively monitor system logs, process execution events, and outbound connection telemetry from Linux hosts to detect unusual relay or tunnel traffic.\n- Implement file integrity monitoring on critical directories to alert on unexpected script drops or binary installations associated with attacker persistence scripts.",[12,13,14,15,16],"MITRE ATT&CK T1572: Protocol Tunneling","MITRE ATT&CK T1053: Scheduled Task\u002FJob","NIST SP 800-53 IR-4: Incident Handling","CIS Control 13: Network Monitoring and Defense","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":18,"MITRE ATT&CK T1053: Scheduled Task\u002FJob":19,"MITRE ATT&CK T1572: Protocol Tunneling":20,"NIST SP 800-53 IR-4: Incident Handling":21,"CIS Control 13: Network Monitoring and Defense":22},"This point mandates effective incident handling procedures, including full eradication of attacker access, which would prevent the scenario where GSocket persistence survives after the initial vulnerability is remediated.","GSocket's deployment script establishes persistence via scheduled jobs or similar mechanisms, which this technique covers and which defenders should hunt for during post-incident review.","GSocket tunnels C2 traffic through a public relay network, which is precisely the technique this ATT&CK entry describes and for which detection guidance is provided.","This control requires organizations to contain, eradicate, and recover from incidents fully, which would have mandated searching for and removing GSocket implants rather than simply patching the initial vulnerability.","This control requires monitoring and analysis of network traffic to detect anomalous outbound connections, which would help surface GSocket's relay-based C2 communications on Linux servers.","published","2026-11-11T21:20:44.390599+00:00","2026-11-11T21:20:44.365+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F11\u002Fglobal-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2\u002F","the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2-f3f53e","The global socket: how threat actors are weaponizing GSocket for stealthy C2",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":54,"name":55,"problem":56},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]