GoKawiilMicrosoft tracks 356% rise in attackers using GSocket for Linux server persistence
Microsoft Defender for Endpoint telemetry shows malicious use of the open-source GSocket tool rising 356.2% between March and August, mostly against web applications and hosting environments. GSocket routes both the compromised server's and the attacker's outbound connections through a relay network, letting attackers reconnect without needing the server's IP address and avoiding any inbound listener. Microsoft found 87.1% of detected cases involved web apps and hosting, with PHP/cPanel systems and Apache servers most affected.