Gsocket - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/gsocket/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 21:35:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgThreat actors weaponizing GSocket for persistent C2 on Linux servershttps://feed.craftedsignal.io/briefs/2026-11-gsocket-weaponization/Wed, 11 Nov 2026 21:35:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gsocket-weaponization/Threat actors are increasingly deploying the legitimate GSocket tool on compromised Linux servers to maintain persistent, encrypted remote access that survives the remediation of initial RCE vulnerabilities.Threat actors are leveraging GSocket, an open-source remote access tool, to maintain persistent, encrypted command-and-control (C2) channels on compromised Linux systems. This technique allows attackers to retain access even after the initial entry-point vulnerability (such as a web application RCE) has been patched. GSocket operates by establishing outbound connections to a public Global Socket Relay Network, bypassing traditional inbound firewall rules and eliminating the need for attacker-controlled C2 infrastructure.

Attack Chain

  1. Initial Access: Threat actors exploit a remote code execution (RCE) vulnerability in an internet-facing application (e.g., PHP-based applications, cPanel, or Apache).
  2. Profiling: The attacker executes commands to profile the system architecture and environment.
  3. Tool Transfer: Using curl or similar utilities, the attacker downloads a GSocket deployment script.
  4. Staging: The script stages the GSocket binary in temporary or memory-backed directories such as /dev/shm to conceal the file.
  5. Execution: The GSocket client is executed, establishing an encrypted outbound connection to the Global Socket Relay Network.
  6. C2 Establishment: The relay bridges the connection between the host and the operator, allowing for persistent, interactive access.
  7. Persistence: The attacker installs persistent mechanisms to survive system reboots.

Impact

This technique enables persistent post-compromise access that remains active after the original vulnerability is remediated. The use of a public relay network makes it difficult for defenders to identify malicious activity based solely on traditional IP or domain-based egress blocking.

Recommendation

  • Implement egress filtering to restrict unauthorized outbound connections to known public relay networks.
  • Monitor for unauthorized execution of binaries from temporary locations such as /dev/shm.
  • Audit for suspicious process names and persistence mechanisms commonly associated with remote access tools.
  • Treat the discovery of GSocket on a host as a sign of a persistent compromise, necessitating deeper incident response beyond simply patching the initial entry-point.
]]>highadvisoryc2linuxgsocketpersistencepersistence-mechanism