# Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)

> Microsoft observed multiple unrelated threat actors deploying the open-source GSocket tool on Linux servers compromised via internet-facing web application RCE, retaining access after the original vulnerabilities were patched. Relay traffic runs through the shared public Global Socket Relay Network, so there is no actor-owned IP or domain to block. Devices with GSocket-related Defender for Endpoint detections rose 356.2% from March through August 2026.

- **Published:** 2026-11-11T21:19:13Z
- **Last reviewed:** 2026-11-11T21:19:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5796
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5796.png
- **ID:** TL-2026-5796
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)
- **CVEs:** CVE-2026-43284

## Description

Microsoft Defender telemetry shows multiple, apparently unrelated, threat actors abusing GSocket (gs-netcat), an open-source tool from The Hacker's Choice, as a post-exploitation C2 and persistence channel on Linux servers. Initial access is exploitation of internet-facing web applications (T1190); commands run as children of the web server or application runtime process, including an encoded RCE command through a vulnerable PHP application. Web applications and hosting made up 87.1% of attributable incidents (PHP web applications and cPanel hosting 63.9%, Apache 24.3%). Education and research was the most affected sector (30.7% of organizations), followed by technology and telecommunications (22.9%); Microsoft assesses this likely reflects exposure (large, decentralized, hard-to-patch academic web estates) rather than deliberate targeting.

The typical chain: curl fetches an installer script (gsocket.io /y or /install.sh) that is piped to bash (T1059.004, T1105); the script profiles the host, selects a GSocket client matching the architecture (x86_64 or aarch64) from cdn.gsocket.io or gsgg.b-cdn.net, and stages it in hidden writable or memory-backed paths such as /dev/shm/.gs-0. The script generates a random shared secret from which GSocket derives its connection identifier and authentication material; the operator can read it from the console, a temp file, or receive it via Telegram (GS_TG_TOKEN / GS_TG_CHATID), Discord or a webhook. Both host and operator connect outbound to the Global Socket Relay Network (GSRN), which pairs the sessions over an end-to-end encrypted channel, so the operator can reconnect from any GSocket client without knowing the victim IP, and there is no actor-owned infrastructure to block. Not every stage occurred in every intrusion.

Persistence is layered: cron (T1053.003), systemd services (T1543.002, e.g. defunct.service and a multi-user.target.wants link), shell profiles, watchdogs and redundant copies, so killing the process alone does not remove access, and access survives remediation of the original web vulnerability. Evasion includes masquerading (binary run as systemd-remount-d; bash exec -a presenting /usr/bin/defunct with argv0 [kaluad]; kernel-thread-like process names), hidden staging directories, chmod 700 on the renamed payload, timestomping of /usr/bin/defunct and defunct.service, deletion of staging artifacts such as /dev/shm/.gs-0/gs-netcat, and attempts to clear command history. In a few incidents actors attempted CVE-2026-43284 (Dirty Frag, Linux kernel xfrm/ESP page-cache write LPE, public PoC since 2026-05-07) to escalate from the web-service account to root; success is not stated.

Corroborating public reporting: SANS ISC (2026-03-20) analyzed a pure-Bash GSocket installer that stores the secret in a fake id_rsa ELF, copies the binary to .ssh/putty, adds an hourly cron and .profile entry, and uses helper functions to restore timestamps; Sansec (2025-04-03) documented GSocket (defunct, defunct.dat, process [mm_percpu_wq], obfuscated hourly cron) on compromised eCommerce stores. No threat actor is named; attribution is not possible because many unrelated actors use the tool.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1053.003 Scheduled Task/Job: Cron
- T1543.002 Create or Modify System Process: Systemd Service
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1036 Masquerading
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1222.002 Linux and Mac Permissions
- T1070.006 Indicator Removal: Timestomp
- T1070.004 Indicator Removal: File Deletion
- T1070.003 Indicator Removal: Clear Command History
- T1090.002 Proxy: External Proxy
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GSocket Persistence and Masquerade Artifacts Written to Disk (defunct, systemd-remount-d, .gs-0) — Post-Exploitation** (`TL-2026-5796-SPL-002`)

Detects creation or modification of known GSocket artifacts for TL-2026-5796: defunct.service, /usr/bin/defunct, defunct.dat, systemd-remount-d in /usr/bin or /tmp, .ssh/putty, hidden staging under /dev/shm/.gs-*, and /tmp/.gsn_ora. These show layered persistence (systemd T1543.002) and hidden staging (T1564.001) that survives patching of the original web vulnerability.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1543.002, T1053.003, T1546.004, T1564.001
- **Data sources:** sysmon_for_linux, defender_for_endpoint_linux, linux_file_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="Syslog:Linux-Sysmon/Operational" EventCode=11
| where match(TargetFilename,"(?i)(/defunct[.]service$|^/usr/bin/defunct$|/defunct[.]dat$|^/usr/bin/systemd-remount-d$|^/tmp/systemd-remount-d$|/[.]ssh/putty$|^/dev/shm/[.]gs-|^/tmp/[.]gsn_ora$)")
| stats count min(_time) as firstTime max(_time) as lastTime values(Image) as writer_images by host, User, TargetFilename
| convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ('FileCreated','FileModified','FileRenamed')
| where FolderPath matches regex @'(?i)(/defunct[.]service$|^/usr/bin/defunct$|/defunct[.]dat$|^/usr/bin/systemd-remount-d$|^/tmp/systemd-remount-d$|/[.]ssh/putty$|^/dev/shm/[.]gs-|^/tmp/[.]gsn_ora$)'
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
```

### Sigma

```yaml
title: GSocket Persistence and Masquerade Artifacts Created on Linux
id: 7b4d9e22-5c1a-4f3b-8d60-2a9e1c4f7b02
status: experimental
description: Detects creation of GSocket files such as defunct.service, /usr/bin/defunct, defunct.dat, systemd-remount-d, .ssh/putty and hidden staging under /dev/shm/.gs-* (TL-2026-5796)
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/
  - https://sansec.io/research/gsocket
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.persistence
  - attack.t1543.002
  - attack.t1053.003
  - attack.t1546.004
  - attack.defense-evasion
  - attack.t1564.001
logsource:
  category: file_event
  product: linux
detection:
  selection_end:
    TargetFilename|endswith:
      - '/defunct.service'
      - '/usr/bin/defunct'
      - '/defunct.dat'
      - '/systemd-remount-d'
      - '/.ssh/putty'
      - '/tmp/.gsn_ora'
  selection_start:
    TargetFilename|startswith: '/dev/shm/.gs-'
  condition: 1 of selection_*
falsepositives:
  - Legitimate software that ships a binary or unit named defunct
  - Administrators who intentionally deploy GSocket for authorized remote access
level: high
```

**Known false positives:**

- Legitimate software shipping a binary or systemd unit named defunct
- Administrators intentionally deploying GSocket for authorized remote access

**Tuning notes:** Requires Sysmon for Linux FileCreate (EventID 11) with rules covering /usr/bin, /etc/systemd, /tmp and /dev/shm. Add attacker-chosen names seen in your environment (e.g. other unit names that reference /dev/shm). Exclude change-managed hosts via a lookup of approved GSocket users.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Web Service Account Privilege Escalation to Root (CVE-2026-43284 Dirty Frag Attempt) — Exploitation (locked: unlock with TL Creds)
- GSocket Persistence Setup via Cron, Systemd Unit or Shell Profile Commands — Post-Exploitation (locked: unlock with TL Creds)
- GSocket Shared-Secret Delivery via GS_TG_* Variables, Telegram or Discord Webhook — C2 Setup (locked: unlock with TL Creds)
- GSocket Installer or Client Binary Download Command Line ([indicator], [indicator]) — Exploitation (locked: unlock with TL Creds)
- GSocket Masquerade Execution and Anti-Forensic Commands (systemd-remount-d, [kaluad], timestomp, history clear) — Post-Exploitation (locked: unlock with TL Creds)
- gs-netcat Listener or Interactive Session Invocation (Including Renamed defunct / systemd-remount-d) — C2 (locked: unlock with TL Creds)
- GSocket Installer Launched by Web Server Runtime (curl|bash from PHP/Apache/nginx/Node/Java) — Exploitation (locked: unlock with TL Creds)
- GSocket Relay Network Egress and Hidden-Path Process Outbound Connections — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- IP address: `45.77.95[.]4`
- Domain: `gsocket[.]io`
- File hash: `d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The global socket: how threat actors are weaponizing GSocket for stealthy C2](https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/)
- [GSocket Backdoor Delivered Through Bash Script (SANS ISC)](https://isc.sans.edu/diary/32816)
- [Found defunct.dat on Your Site? You've Got a Problem (Sansec)](https://sansec.io/research/gsocket)
- [GSocket - The Hacker's Choice (GitHub)](https://github.com/hackerschoice/gsocket)
- [Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments](https://www.microsoft.com/en-us/security/blog/2026/04/02/cookie-controlled-php-webshells-tradecraft-linux-hosting-environments/)
- [NVD - CVE-2026-43284](https://nvd.nist.gov/vuln/detail/CVE-2026-43284)
- [Dirty Frag PoC and technical write-up (V4bel/dirtyfrag)](https://github.com/V4bel/dirtyfrag)
- [Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC (Wiz)](https://wiz.io/blog/dirty-frag-linux-kernel-local-privilege-escalation-via-esp-and-rxrpc)
- [GSocket Backdoor Analysis (SOC Prime)](https://socprime.com/active-threats/gsocket-backdoor-analysis/)
- [The Nine Lives of Commando Cat: Novel Malware Campaign Targeting Docker (Cado Security)](https://cadosecurity.com/the-nine-lives-of-commando-cat-analysing-a-novel-malware-campaign-targeting-docker)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5796