Threat actors weaponizing GSocket for persistent C2 on Linux servers

Threat actors are leveraging GSocket, an open-source remote access tool, to maintain persistent, encrypted command-and-control (C2) channels on compromised Linux systems. This technique allows attackers to retain access even after the initial entry-point vulnerability (such as a web application RCE) has been patched. GSocket operates by establishing outbound connections to a public Global Socket Relay Network, bypassing traditional inbound firewall rules and eliminating the need for attacker-controlled C2 infrastructure.

Attack Chain

1. Initial Access: Threat actors exploit a remote code execution (RCE) vulnerability in an internet-facing application (e.g., PHP-based applications, cPanel, or Apache).
2. Profiling: The attacker executes commands to profile the system architecture and environment.
3. Tool Transfer: Using curl or similar utilities, the attacker downloads a GSocket deployment script.
4. Staging: The script stages the GSocket binary in temporary or memory-backed directories such as /dev/shm to conceal the file.
5. Execution: The GSocket client is executed, establishing an encrypted outbound connection to the Global Socket Relay Network.
6. C2 Establishment: The relay bridges the connection between the host and the operator, allowing for persistent, interactive access.
7. Persistence: The attacker installs persistent mechanisms to survive system reboots.

Impact

This technique enables persistent post-compromise access that remains active after the original vulnerability is remediated. The use of a public relay network makes it difficult for defenders to identify malicious activity based solely on traditional IP or domain-based egress blocking.

Recommendation

• Implement egress filtering to restrict unauthorized outbound connections to known public relay networks.
• Monitor for unauthorized execution of binaries from temporary locations such as /dev/shm.
• Audit for suspicious process names and persistence mechanisms commonly associated with remote access tools.
• Treat the discovery of GSocket on a host as a sign of a persistent compromise, necessitating deeper incident response beyond simply patching the initial entry-point.