vendor research (Microsoft Threat Intelligence, Nov 11, 2026)
Hunt: GSocket relay clients left on Linux web servers keep access after the original web app bug is patched
Deployment: curl-to-bash from gsocket[.]io/y or /install.sh; binaries from cdn[.]gsocket[.]io and gsgg[.]b-cdn[.]net, staged in /dev/shm/.gs-0/.
Disguise and persistence: kernel-thread-style names such as [kaluad], files named systemd-remount-d, /usr/bin/defunct with defunct.service, /tmp/.gsn_ora; cron, systemd, shell-profile and watchdog copies; timestomped files and deleted staging.
Secret delivery: the reconnect secret can be sent through Telegram (GS_TG_TOKEN, GS_TG_CHATID), Discord or a webhook.
Hunt: web server or PHP processes spawning shells and curl; process names or command lines containing gs-netcat or gsocket.io; execution from hidden or memory-backed paths. SHA-256s and Defender XDR queries are in the post.
Remediate: patching the web app is not enough. Remove the client and every persistence copy, confirm outbound relay connections stop, deny-by-default egress, mount /dev/shm and /tmp noexec where you can, and patch local kernel privilege escalations.