---
title: Hunt: GSocket relay clients left on Linux web servers keep access after the original web app bug is patched | ctxsec
url: https://ctxsec.com/items/hunt-microsoft-gsocket-gs-netcat-relay-persistence-linux-web-servers-dev-shm-defunct
description: "Microsoft has seen several unrelated actors exploit internet-facing web apps and then install GSocket, an open-source tool that connects both the victim and the operator outbound to the public Global Socket Relay Network, so there is no attacker IP or domain to block. Devices with GSocket-related detections rose 356.2% from March to August 2026. Web apps and hosting made up 87.1% of attributable incidents (PHP apps and cPanel 63.9%, Apache 24.3%), and education and research was the most affected sector. In a few cases the actors also tried the Dirty Frag kernel bug CVE-2026-43284 to get root."
status: "vendor research (Microsoft Threat Intelligence, Nov 11, 2026)"
published: 2026-11-11
---

> Microsoft has seen several unrelated actors exploit internet-facing web apps and then install GSocket, an open-source tool that connects both the victim and the operator outbound to the public Global Socket Relay Network, so there is no attacker IP or domain to block. Devices with GSocket-related detections rose 356.2% from March to August 2026. Web apps and hosting made up 87.1% of attributable incidents (PHP apps and cPanel 63.9%, Apache 24.3%), and education and research was the most affected sector. In a few cases the actors also tried the Dirty Frag kernel bug CVE-2026-43284 to get root.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-microsoft-gsocket-gs-netcat-relay-persistence-linux-web-servers-dev-shm-defunct.md)

vendor research (Microsoft Threat Intelligence, Nov 11, 2026)

2026-11-11 3:36 PM ET

### Hunt: GSocket relay clients left on Linux web servers keep access after the original web app bug is patched

- **Deployment:** curl-to-bash from `gsocket[.]io/y` or `/install.sh`; binaries from `cdn[.]gsocket[.]io` and `gsgg[.]b-cdn[.]net`, staged in `/dev/shm/.gs-0/`.
- **Disguise and persistence:** kernel-thread-style names such as `[kaluad]`, files named `systemd-remount-d`, `/usr/bin/defunct` with `defunct.service`, `/tmp/.gsn_ora`; cron, systemd, shell-profile and watchdog copies; timestomped files and deleted staging.
- **Secret delivery:** the reconnect secret can be sent through Telegram (`GS_TG_TOKEN`, `GS_TG_CHATID`), Discord or a webhook.
- **Hunt:** web server or PHP processes spawning shells and curl; process names or command lines containing `gs-netcat` or `gsocket.io`; execution from hidden or memory-backed paths. SHA-256s and Defender XDR queries are in the post.
- **Remediate:** patching the web app is not enough. Remove the client and every persistence copy, confirm outbound relay connections stop, deny-by-default egress, mount `/dev/shm` and `/tmp` noexec where you can, and patch local kernel privilege escalations.

Sources: [Microsoft Security Blog: The global socket, how threat actors are weaponizing GSocket for stealthy C2 (Nov 11, 2026)](https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/)