GoKawiilMicrosoft tracks 356% rise in attackers using GSocket for Linux server persistence
Microsoft Defender for Endpoint telemetry shows malicious use of the open-source GSocket tool rising 356.2% between March and August, mostly against web applications and hosting environments. GSocket routes both the compromised server's and the attacker's outbound connections through a relay network, letting attackers reconnect without needing the server's IP address and avoiding any inbound listener. Microsoft found 87.1% of detected cases involved web apps and hosting, with PHP/cPanel systems and Apache servers most affected.
GoKawiil's interpretation of the reporting above, not reported fact.
Because both sides of the connection are outbound, standard inbound firewall rules and IP-based blocklists can't catch this traffic, which could let attackers keep access to a server even after the original vulnerability is patched. Microsoft notes that only egress filtering and outbound traffic monitoring can detect this activity, suggesting defenders may need to rethink detection strategies focused solely on inbound threats. The technique's abuse of a legitimate, widely available tool could also make malicious use harder to distinguish from legitimate remote-access traffic.
- GSocket abuse detections rose 356.2% from March to August, per Microsoft telemetry.
- The tool lets attackers maintain persistent access via outbound-only connections through a relay network, bypassing inbound firewall rules.
- 87.1% of observed incidents hit web applications and hosting, especially PHP/cPanel and Apache environments.
Source: bleepingcomputer.com, 2026-11-12
Published there as: “Hackers plant GSocket on Linux servers for persistent access”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.