Microsoft says Linux GSocket detections rose 356.2%

Microsoft says devices with GSocket-related detections on Linux increased 356.2% from March through August 2026, and that the increase was not consistent from month to month. The November 11 research post is by Yash Gund and Sumith Maniath of Microsoft Security Research.

Attackers kept access after the original flaws were fixed. Microsoft says it observed multiple incidents in which threat actors deployed GSocket, an open-source remote access tool, on compromised Linux servers. They used it to maintain access after the vulnerabilities used for the first break-in were remediated.

A patched web application was not the end of the intrusion. Microsoft says a single web application compromise became persistent access that outlasted remediation of the original vulnerabilities. It says defenders should look for GSocket deployment, persistence, privilege escalation, and outbound connections, rather than treating an application patch as complete. Defender telemetry shows the activity growing over recent months and concentrated on web applications and hosting environments.

The tool uses a public relay, not an attacker-owned server. GSocket sends traffic through the Global Socket Relay Network. Microsoft says the operator does not have to register or host infrastructure, so there is no threat-actor-owned IP address or domain to block. The compromised host and the operator both connect outbound, and the relay bridges the two sessions. The host needs no inbound listener and no public IP address.

A few incidents tried a Linux kernel flaw for root. In a few observed incidents, Microsoft says the attackers attempted to exploit CVE-2026-43284, also called Dirty Frag, to raise privileges from the web-service account to root. It describes those as attempts.

Stopping the process does not clear the host. Microsoft says persistence is often layered across cron entries, systemd units, and shell startup files, so stopping the running process alone does not remove access. It advises deny-by-default outbound rules, monitoring of relay connections, and a review of those startup surfaces, along with a patch for CVE-2026-43284 on internet-facing servers.