Microsoft: patching the web app does not remove GSocket planted on Linux web servers

Microsoft said Nov. 11 that unrelated threat actors deployed the open-source GSocket relay client on compromised Linux servers and kept access after the exploited vulnerabilities were remediated. If a web server was ever compromised, the host is the incident: hunt for the client and its persistence, and default-deny its outbound traffic.

What happened

In a Nov. 11 post, Microsoft Security Research said threat actors exploited internet-facing web applications and used curl to download and execute a remote script. The script profiled the host, picked a client by architecture, staged it in /dev/shm and connected out through the Global Socket Relay Network. In some intrusions the actors used kernel-thread-like process names, persisted through cron, systemd, shell profiles, watchdogs and redundant copies, then deleted staging files. The post names no CVE for initial access, so no single patch answers it.

In a few incidents they attempted root through CVE-2026-43284 (Dirty Frag), a local Linux kernel flaw. Microsoft does not say whether any worked.

Microsoft's reasoning: "Because GSocket runs independently of the exploited application, patching the vulnerability does not remove the relay client or its persistence." Blocking is hard because "GSocket relays traffic through a shared public network, so there is no threat actor-owned IP address or domain to block." Microsoft adds that the relay itself can still be restricted, and that egress filtering and outbound monitoring see traffic inbound firewall rules miss.

Who is affected

Web applications and hosting made up 87.1% of attributable incidents in Microsoft Defender for Endpoint telemetry. Of those, PHP applications and cPanel hosting were 63.9% and Apache 24.3%. Education and research made up 30.7% of affected organizations, technology and telecommunications 22.9%. Microsoft said "exposure is the more likely factor" than deliberate targeting: "academic institutions often run large, decentralized web estates maintained outside central IT."

Devices with GSocket-related detections in that telemetry rose 356.2% from March through August 2026, not steadily. Microsoft gives no count of US victims.

What to hunt

Microsoft's indicators (not a complete inventory, it says):

• Shells launched from web servers and application runtimes, or curl fetching a script for bash.
• /dev/shm/.gs-0/, /tmp/.gsn_ora, a binary named systemd-remount-d, /usr/bin/defunct shown as [kaluad], defunct.service.
• New cron entries, systemd units with plausible names, changed shell startup files.
• Distribution domains gsocket[.]io, cdn[.]gsocket[.]io and gsgg[.]b-cdn[.]net, which Microsoft calls "tool distribution endpoints, not threat actor-owned command and control". It names no relay hostname.
• Microsoft says the secret can be delivered through a channel such as Telegram, Discord or a webhook; we would watch for those connections.

Because the attackers deleted staging files, their absence does not clear a host.

What to do now

• SOC, today: run the hunt on every Linux web server that was ever compromised, as far back as logs go.
• IR lead, this week, on any hit: treat the host as compromised, not just the app. Microsoft says to remove the client, persistence and staged files, then confirm relay traffic stopped. We would preserve evidence first, rebuild where you can and rotate every secret the web user could read (app config, database, API keys). Check whether the root attempt worked.
• Network team, this week: apply deny-by-default egress for web servers, as Microsoft advises. In our view, alerting on the distribution domains is a cheap tripwire where servers have no reason to reach them, not a fix.
• Platform engineering, this month: mount /tmp and /dev/shm noexec where feasible, restrict upload and admin paths, and prioritize local privilege-escalation patching on internet-facing servers, as Microsoft advises. We would add EDR on Linux servers.

What is not known yet

Microsoft does not say which applications or CVEs gave the attackers entry, or who they are, so a patched app does not clear the server.