Skip to navigation

Threat reportMalwareTL-2026-5796

Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)

highACTIVE

Microsoft observed multiple unrelated threat actors deploying the open-source GSocket tool on Linux servers compromised via internet-facing web application RCE, retaining access after the original vulnerabilities were patched. Relay traffic runs through the shared public Global Socket Relay Network, so there is no actor-owned IP or domain to block.

Key facts

IdentifiersTL-2026-5796, CVE-2026-43284
Also known asGSocket, gs-netcat, Global Socket, GsNetcat
SeverityHIGH
First disclosed
EPSSCVE-2026-43284: 2.4% (84.0th percentile)
Affected productsLinux Internet-facing Linux web servers (PHP/cPanel hosting, Apache, Java and Node web applications); Linux Linux kernel (CVE-2026-43284 xfrm/ESP, Dirty Frag)
Weaknesses (CWE)CWE-123
MalwareHackTool:Linux/GsNetcat, PHP
ToolsNetcat
MITRE ATT&CK techniquesT1036 Masquerading, T1053.003 Scheduled Task/Job: Cron, T1059.004 Command and Scripting Interpreter: Unix Shell, T1070.003 Indicator Removal: Clear Command History, T1070.004 Indicator Removal: File Deletion, T1070.006 Indicator Removal: Timestomp, T1090.002 Proxy: External Proxy, T1190 Exploit Public-Facing Application, T1222.002 Linux and Mac Permissions, T1543.002 Create or Modify System Process: Systemd Service, T1546.004 Event Triggered Execution: Unix Shell Configuration Modification, T1564.001 Hide Artifacts: Hidden Files and Directories and 1 more in the attack flow
MotivationUNKNOWN
Target sectorseducation, research, technology, telecoms, web hosting
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5796 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GSocket Persistence and Masquerade Artifacts Written to Disk (defunct, systemd-remount-d, .gs-0) — Post-Exploitation

Detects creation or modification of known GSocket artifacts for TL-2026-5796: defunct.service, /usr/bin/defunct, defunct.dat, systemd-remount-d in /usr/bin or /tmp, .ssh/putty, hidden staging under /dev/shm/.gs-*, and /tmp/.gsn_ora. These show layered persistence (systemd T1543.002) and hidden staging (T1564.001) that survives patching of the original web vulnerability.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1543.002, T1053.003, T1546.004, T1564.001
  • Data sources: sysmon_for_linux, defender_for_endpoint_linux, linux_file_events
  • Severity: high
  • Confidence: high

Splunk SPL

index=linux sourcetype="Syslog:Linux-Sysmon/Operational" EventCode=11
| where match(TargetFilename,"(?i)(/defunct[.]service$|^/usr/bin/defunct$|/defunct[.]dat$|^/usr/bin/systemd-remount-d$|^/tmp/systemd-remount-d$|/[.]ssh/putty$|^/dev/shm/[.]gs-|^/tmp/[.]gsn_ora$)")
| stats count min(_time) as firstTime max(_time) as lastTime values(Image) as writer_images by host, User, TargetFilename
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ('FileCreated','FileModified','FileRenamed')
| where FolderPath matches regex @'(?i)(/defunct[.]service$|^/usr/bin/defunct$|/defunct[.]dat$|^/usr/bin/systemd-remount-d$|^/tmp/systemd-remount-d$|/[.]ssh/putty$|^/dev/shm/[.]gs-|^/tmp/[.]gsn_ora$)'
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

Sigma

title: GSocket Persistence and Masquerade Artifacts Created on Linux
id: 7b4d9e22-5c1a-4f3b-8d60-2a9e1c4f7b02
status: experimental
description: Detects creation of GSocket files such as defunct.service, /usr/bin/defunct, defunct.dat, systemd-remount-d, .ssh/putty and hidden staging under /dev/shm/.gs-* (TL-2026-5796)
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/
  - https://sansec.io/research/gsocket
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.persistence
  - attack.t1543.002
  - attack.t1053.003
  - attack.t1546.004
  - attack.defense-evasion
  - attack.t1564.001
logsource:
  category: file_event
  product: linux
detection:
  selection_end:
    TargetFilename|endswith:
      - '/defunct.service'
      - '/usr/bin/defunct'
      - '/defunct.dat'
      - '/systemd-remount-d'
      - '/.ssh/putty'
      - '/tmp/.gsn_ora'
  selection_start:
    TargetFilename|startswith: '/dev/shm/.gs-'
  condition: 1 of selection_*
falsepositives:
  - Legitimate software that ships a binary or unit named defunct
  - Administrators who intentionally deploy GSocket for authorized remote access
level: high

Known false positives:

  • Legitimate software shipping a binary or systemd unit named defunct
  • Administrators intentionally deploying GSocket for authorized remote access

Tuning notes: Requires Sysmon for Linux FileCreate (EventID 11) with rules covering /usr/bin, /etc/systemd, /tmp and /dev/shm. Add attacker-chosen names seen in your environment (e.g. other unit names that reference /dev/shm). Exclude change-managed hosts via a lookup of approved GSocket users.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Web Service Account Privilege Escalation to Root (CVE-2026-43284 Dirty Frag Attempt) — Exploitation · unlock with TL Creds
  • GSocket Persistence Setup via Cron, Systemd Unit or Shell Profile Commands — Post-Exploitation · unlock with TL Creds
  • GSocket Shared-Secret Delivery via GS_TG_* Variables, Telegram or Discord Webhook — C2 Setup · unlock with TL Creds
  • GSocket Installer or Client Binary Download Command Line ([indicator], [indicator]) — Exploitation · unlock with TL Creds
  • GSocket Masquerade Execution and Anti-Forensic Commands (systemd-remount-d, [kaluad], timestomp, history clear) — Post-Exploitation · unlock with TL Creds
  • gs-netcat Listener or Interactive Session Invocation (Including Renamed defunct / systemd-remount-d) — C2 · unlock with TL Creds
  • GSocket Installer Launched by Web Server Runtime (curl|bash from PHP/Apache/nginx/Node/Java) — Exploitation · unlock with TL Creds
  • GSocket Relay Network Egress and Hidden-Path Process Outbound Connections — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-5796.

Sample indicators (3 of 23)

  • IP address: 45.77.95[.]4
  • Domain: gsocket[.]io
  • File hash: d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

23 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Devices with GSocket-related Defender for Endpoint detections rose 356.2% from March through August 2026.

Microsoft Defender telemetry shows multiple, apparently unrelated, threat actors abusing GSocket (gs-netcat), an open-source tool from The Hacker's Choice, as a post-exploitation C2 and persistence channel on Linux servers. Initial access is exploitation of internet-facing web applications (T1190); commands run as children of the web server or application runtime process, including an encoded RCE command through a vulnerable PHP application. Web applications and hosting made up 87.1% of attributable incidents (PHP web applications and cPanel hosting 63.9%, Apache 24.3%). Education and research was the most affected sector (30.7% of organizations), followed by technology and telecommunications (22.9%); Microsoft assesses this likely reflects exposure (large, decentralized, hard-to-patch academic web estates) rather than deliberate targeting.

The typical chain: curl fetches an installer script (gsocket.io /y or /install.sh) that is piped to bash (T1059.004, T1105); the script profiles the host, selects a GSocket client matching the architecture (x86_64 or aarch64) from cdn.gsocket.io or gsgg.b-cdn.net, and stages it in hidden writable or memory-backed paths such as /dev/shm/.gs-0. The script generates a random shared secret from which GSocket derives its connection identifier and authentication material; the operator can read it from the console, a temp file, or receive it via Telegram (GS_TG_TOKEN / GS_TG_CHATID), Discord or a webhook. Both host and operator connect outbound to the Global Socket Relay Network (GSRN), which pairs the sessions over an end-to-end encrypted channel, so the operator can reconnect from any GSocket client without knowing the victim IP, and there is no actor-owned infrastructure to block. Not every stage occurred in every intrusion.

Persistence is layered: cron (T1053.003), systemd services (T1543.002, e.g. defunct.service and a multi-user.target.wants link), shell profiles, watchdogs and redundant copies, so killing the process alone does not remove access, and access survives remediation of the original web vulnerability. Evasion includes masquerading (binary run as systemd-remount-d; bash exec -a presenting /usr/bin/defunct with argv0 [kaluad]; kernel-thread-like process names), hidden staging directories, chmod 700 on the renamed payload, timestomping of /usr/bin/defunct and defunct.service, deletion of staging artifacts such as /dev/shm/.gs-0/gs-netcat, and attempts to clear command history. In a few incidents actors attempted CVE-2026-43284 (Dirty Frag, Linux kernel xfrm/ESP page-cache write LPE, public PoC since 2026-05-07) to escalate from the web-service account to root; success is not stated.

Corroborating public reporting: SANS ISC (2026-03-20) analyzed a pure-Bash GSocket installer that stores the secret in a fake id_rsa ELF, copies the binary to .ssh/putty, adds an hourly cron and .profile entry, and uses helper functions to restore timestamps; Sansec (2025-04-03) documented GSocket (defunct, defunct.dat, process [mm_percpu_wq], obfuscated hourly cron) on compromised eCommerce stores. No threat actor is named; attribution is not possible because many unrelated actors use the tool.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1070.003 Indicator Removal: Clear Command History; T1070.004 Indicator Removal: File Deletion; T1070.006 Indicator Removal: Timestomp; T1564.001 Hide Artifacts: Hidden Files and Directories

Persistence

T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Command and Control

T1090.002 Proxy: External Proxy; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1222.002 Linux and Mac Permissions

Remediation

Patches

  • Keep web applications, CMS platforms, plugins and app servers current
  • Patch Linux kernels for CVE-2026-43284: fixed in 5.10.255, 5.15.205, 6.1.171, 6.6.138, 6.12.87, 6.18.28, 7.0.5 or vendor errata (e.g. RHEL 8 4.18.0-553.124.1.el8_10, RHEL 9 5.14.0-611.55.1.el9_7)

Immediate actions

  • Hunt for GSocket artifacts: /dev/shm/.gs-*, /tmp/.gsn_ora, /usr/bin/defunct, defunct.service, systemd-remount-d, defunct.dat
  • Remediate the host, not only the vulnerability: remove the GSocket client, cron/systemd/shell-profile persistence and staged files, then verify outbound relay connections have stopped
  • Review cron entries, systemd units with plausible service names and shell startup files (.profile, .bashrc)
  • Block or monitor egress to gsocket.io, cdn.gsocket.io and gsgg.b-cdn.net and to the GSRN relay where operationally feasible

Workarounds

  • Remove unused web components and restrict file-upload and admin paths
  • Restrict access to the GSocket relay network at the network edge

Longer-term hardening

  • Apply deny-by-default egress filtering from internet-facing servers and monitor relay connections
  • Mount /tmp, /dev/shm and other temp or memory-backed directories noexec where feasible and alert on execution from hidden or world-writable paths
  • Alert on shells and downloaders spawned by web server and application runtime processes
  • Enable Microsoft Defender for Endpoint on Linux with real-time, cloud-delivered protection and behavior monitoring

Affected and fixed versions

  • Linux — Internet-facing Linux web servers (PHP/cPanel hosting, Apache, Java and Node web applications)
    Vulnerable versions: Servers running exploitable internet-facing web applications
    Fixed in: Remediate the web application vulnerability and remove GSocket persistence
  • Linux — Linux kernel (CVE-2026-43284 xfrm/ESP, Dirty Frag)
    Vulnerable versions: 4.11 to before 5.10.255; 5.12 to before 5.15.205; 5.16 to before 6.1.171; 6.2 to before 6.6.138; 6.7 to before 6.12.87; 6.13 to before 6.18.28; 7.0 to before 7.0.5
    Fixed in: 5.10.255; 5.15.205; 6.1.171; 6.6.138; 6.12.87; 6.18.28; 7.0.5

Timeline

  • Sansec publishes research on GSocket backdoors (defunct, locked-ioc-17, hourly obfuscated cron, process [mm_percpu_wq]) on compromised eCommerce stores; 45 of 80,000 scanned stores had running GSocket.
  • Start of the March-August 2026 window in which Defender for Endpoint devices with GSocket-related detections grew 356.2% (growth not consistent month to month).
  • SANS ISC publishes analysis of a pure-Bash GSocket installer using hourly cron, .profile persistence, a fake id_rsa ELF, and timestamp-restoring helper functions.
  • Microsoft publishes related research on cookie-controlled PHP webshells in Linux hosting environments, referenced by the GSocket report.
  • Dirty Frag Linux kernel LPE (CVE-2026-43284 / CVE-2026-43500) publicly disclosed with a working PoC.
  • CVE-2026-43284 published in NVD (CVSS 3.1 8.8 per Linux kernel CNA); fixes in stable kernels 5.10.255 through 7.0.5.
  • End of the observation window (March-August 2026); web applications and hosting account for 87.1% of attributable incidents.
  • Microsoft publishes 'The global socket' report on multiple threat actors weaponizing GSocket for stealthy C2 and post-patch persistence on Linux servers.

Sources cited

Other reports on CVE-2026-43284

Further reading

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats