Bleeping Computer reports that multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain persistent access to Linux servers even after initial vulnerabilities are patched.
Since March, detections of malicious GSocket activity have risen by 356.2%, according to Microsoft Defender for Endpoint. The tool allows attackers to bypass firewalls and network address translation by routing traffic through the Global Socket Relay Network. Because both the compromised host and the attacker initiate outbound connections to the relay, the setup requires no inbound listeners, making it difficult for traditional access control lists to block. Attackers often disguise the tool as kernel threads and establish persistence via cron jobs, systemd services or shell startup files. Data indicates 87.1% of these incidents target web applications and hosting environments, specifically PHP, cPanel and Apache. Some attackers have also attempted to exploit the Dirty Frag Linux kernel flaw to gain root privileges. Microsoft reports that the education, research, technology and manufacturing sectors are primary targets. Security experts recommend that administrators audit system services, restrict outbound traffic to known destinations and ensure all software is updated to mitigate these stealthy command-and-control tactics.
Source: Bleeping Computer
