{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/gsocket/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PHP","Apache HTTP Server","cPanel"],"_cs_severities":["high"],"_cs_tags":["c2","linux","gsocket","persistence","persistence-mechanism"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThreat actors are leveraging GSocket, an open-source remote access tool, to maintain persistent, encrypted command-and-control (C2) channels on compromised Linux systems. This technique allows attackers to retain access even after the initial entry-point vulnerability (such as a web application RCE) has been patched. GSocket operates by establishing outbound connections to a public Global Socket Relay Network, bypassing traditional inbound firewall rules and eliminating the need for attacker-controlled C2 infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: Threat actors exploit a remote code execution (RCE) vulnerability in an internet-facing application (e.g., PHP-based applications, cPanel, or Apache).\u003c/li\u003e\n\u003cli\u003eProfiling: The attacker executes commands to profile the system architecture and environment.\u003c/li\u003e\n\u003cli\u003eTool Transfer: Using curl or similar utilities, the attacker downloads a GSocket deployment script.\u003c/li\u003e\n\u003cli\u003eStaging: The script stages the GSocket binary in temporary or memory-backed directories such as /dev/shm to conceal the file.\u003c/li\u003e\n\u003cli\u003eExecution: The GSocket client is executed, establishing an encrypted outbound connection to the Global Socket Relay Network.\u003c/li\u003e\n\u003cli\u003eC2 Establishment: The relay bridges the connection between the host and the operator, allowing for persistent, interactive access.\u003c/li\u003e\n\u003cli\u003ePersistence: The attacker installs persistent mechanisms to survive system reboots.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis technique enables persistent post-compromise access that remains active after the original vulnerability is remediated. The use of a public relay network makes it difficult for defenders to identify malicious activity based solely on traditional IP or domain-based egress blocking.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement egress filtering to restrict unauthorized outbound connections to known public relay networks.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized execution of binaries from temporary locations such as /dev/shm.\u003c/li\u003e\n\u003cli\u003eAudit for suspicious process names and persistence mechanisms commonly associated with remote access tools.\u003c/li\u003e\n\u003cli\u003eTreat the discovery of GSocket on a host as a sign of a persistent compromise, necessitating deeper incident response beyond simply patching the initial entry-point.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T21:35:25Z","date_published":"2026-11-11T21:35:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gsocket-weaponization/","summary":"Threat actors are increasingly deploying the legitimate GSocket tool on compromised Linux servers to maintain persistent, encrypted remote access that survives the remediation of initial RCE vulnerabilities.","title":"Threat actors weaponizing GSocket for persistent C2 on Linux servers","url":"https://feed.craftedsignal.io/briefs/2026-11-gsocket-weaponization/"}],"language":"en","title":"CraftedSignal Threat Feed - Gsocket","version":"https://jsonfeed.org/version/1.1"}