ThreatsDay Roundup: Microsoft MDASH Linux Kernel Bugs (CVE-2026-64563), Falcon Browser Spyware, GSocket Backdoors

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5881 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GSocket Persistence and Staging Artifacts: cron, systemd, Shell Startup (Post-Exploitation)

Detects the Microsoft-reported GSocket artifacts: gs-netcat staged under /dev/shm/.gs-0/, the /tmp/.gsn_ora payload, binaries masquerading as systemd-remount-d or /usr/bin/defunct (launched with exec -a [kaluad]) and the defunct.service unit. Also flags cron, systemd or shell-startup files written by a process running out of /dev/shm, /tmp or /var/tmp, the persistence methods that let GSocket survive patching of the original flaw (TL-2026-5881).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1053.003, T1543.002, T1036, T1564.001
• Data sources: sysmon_for_linux (index=linux, sourcetype=sysmon:linux, EventID 1 and 11), microsoft_defender_for_endpoint (DeviceProcessEvents, DeviceFileEvents), linux_file_event
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventID IN (1, 11) earliest=-24h
| eval artifact=coalesce(TargetFilename, CommandLine), creator=coalesce(Image, "unknown")
| eval gsocket_artifact=if(match(artifact, "(?i)(/dev/shm/[.]gs-|[.]gsn_ora|systemd-remount-d|/usr/bin/defunct|defunct[.]service|kaluad|gs-netcat)"), 1, 0)
| eval persist_from_tmp=if(match(artifact, "(?i)(^/etc/cron|^/var/spool/cron|^/etc/systemd/system/|^/usr/lib/systemd/system/|[.]bashrc$|[.]profile$|[.]bash_profile$|[.]zshrc$)") AND match(creator, "^(/dev/shm|/tmp|/var/tmp)/"), 1, 0)
| where gsocket_artifact=1 OR persist_from_tmp=1
| eval persistence_type=case(match(artifact, "(?i)[.]service"), "systemd_service", match(artifact, "(?i)cron"), "cron", match(artifact, "(?i)(bashrc|profile|zshrc)"), "shell_startup", true(), "staging_or_masquerade")
| stats count min(_time) as first_seen max(_time) as last_seen values(artifact) as artifacts values(creator) as creators by host User persistence_type
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let gs_regex = @'(?i)(/dev/shm/[.]gs-|[.]gsn_ora|systemd-remount-d|/usr/bin/defunct|defunct[.]service|kaluad|gs-netcat)';
let persist_regex = @'(?i)(^/etc/cron|^/var/spool/cron|^/etc/systemd/system/|^/usr/lib/systemd/system/|[.]bashrc$|[.]profile$|[.]bash_profile$|[.]zshrc$)';
let proc_hits = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine matches regex gs_regex
    | project Timestamp, DeviceName, AccountName, Signal='process_cmdline', Artifact=ProcessCommandLine, Actor=InitiatingProcessFileName;
let file_hits = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ('FileCreated','FileModified','FileRenamed')
    | where FolderPath matches regex gs_regex or (FolderPath matches regex persist_regex and InitiatingProcessFolderPath matches regex @'^/(dev/shm|tmp|var/tmp)/')
    | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Signal='file_event', Artifact=FolderPath, Actor=InitiatingProcessFolderPath;
union proc_hits, file_hits
| order by Timestamp desc

Sigma

title: GSocket Persistence and Staging Artifacts on Linux
id: 7b2d9e14-5a3c-4f68-8c0b-2e91d4a6f302
status: experimental
description: Detects creation of GSocket (gs-netcat) artifacts such as /dev/shm/.gs-0, .gsn_ora, systemd-remount-d, /usr/bin/defunct and defunct.service, and cron, systemd or shell startup files written by a process running from /dev/shm, /tmp or /var/tmp (TL-2026-5881).
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.persistence
    - attack.t1053.003
    - attack.t1543.002
    - attack.defense-evasion
    - attack.t1036
    - attack.t1564.001
logsource:
    category: file_event
    product: linux
detection:
    selection_gs:
        TargetFilename|contains:
            - '/dev/shm/.gs-'
            - '.gsn_ora'
            - 'systemd-remount-d'
            - '/usr/bin/defunct'
            - 'defunct.service'
    selection_persist_path:
        TargetFilename|startswith:
            - '/etc/cron'
            - '/var/spool/cron'
            - '/etc/systemd/system/'
            - '/usr/lib/systemd/system/'
    selection_persist_startup:
        TargetFilename|endswith:
            - '/.bashrc'
            - '/.profile'
            - '/.bash_profile'
            - '/.zshrc'
    selection_staging_image:
        Image|startswith:
            - '/dev/shm/'
            - '/tmp/'
            - '/var/tmp/'
    condition: selection_gs or ((selection_persist_path or selection_persist_startup) and selection_staging_image)
falsepositives:
    - Administrators running self-extracting installers from /tmp that register a service or cron job
    - Authorized use of GSocket for remote administration
level: high

Known false positives:

• Self-extracting software installers that run from /tmp and register a cron job or systemd unit
• Authorized administrators using GSocket for legitimate remote access

Tuning notes: Allowlist known installer paths and configuration-management accounts in the persist_from_tmp arm. The named-artifact arm (.gs-0, .gsn_ora, defunct.service, systemd-remount-d) is high fidelity and should alert without tuning. Ensure Sysmon for Linux logs FileCreate (EventID 11) for /etc/cron*, /etc/systemd and home-directory startup files.

• 🔒 Root Shell Spawned from User-Writable Path Without sudo/su (Linux Kernel LPE, CVE-2026-64563 Family) · unlock with TL Creds
• 🔒 Antino Persistence via sdiagnhost.exe Scripted Diagnostic and Run Key (Post-Exploitation) · unlock with TL Creds
• 🔒 Antino OneDrive/Microsoft Graph C2 from Non-Browser Process in User-Writable Path (C2) · unlock with TL Creds
• 🔒 Falcon Malicious Browser Extension and Fake Flash Installer Dropped to Disk (Exploitation) · unlock with TL Creds
• 🔒 Execution from Hidden /dev/shm Directory and Process-Name Masquerade (Post-Exploitation) · unlock with TL Creds
• 🔒 GSocket Relay C2: Outbound Connection from Staged or Masqueraded gs-netcat Binary (C2) · unlock with TL Creds
• 🔒 GSocket Installer or curl-pipe-shell Spawned by Web Server Process (Exploitation) · unlock with TL Creds
• 🔒 Web and Proxy Access to Falcon, Antino Delivery, GSocket and Flowise Beacon Infrastructure (C2) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5881.

Sample indicators (3 of 27)

• IP address: 154.217.251[.]226
• Domain: fonts[.]tarotfree101[.]top
• File hash: 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Technical analysis

This record tracks a multi-item roundup. Authoritative detail comes from the primary vendor reports cited below; CVSS is not stated by the source for CVE-2026-64563, so cvss_score is left null (third-party trackers list 7.8 preliminarily, unconfirmed by NVD in this research).

Kernel: Microsoft's FORGE Lab used an AI-assisted pipeline (MDASH) to scan a subset of Linux kernel subsystems from late May to mid-June 2026, yielding 26,502 raw findings, 621 PoC-backed cases, 59 upstream reports and 33 assigned CVEs, 24 rated High or above. Working local root privilege-escalation exploits were confirmed in the lab for eight CVEs (CVE-2026-64554, -64563, -64580, -74561, -74562, -89789, -98222, -98364), spanning net/ipv4, net/ipv6, net/xfrm, drivers/net (GTP), security/keys and lib/rhashtable. CVE-2026-64563 is a use-after-free in rhashtable_walk_start_check(): a 2018 commit (5d240a8936f6) moved the reset of iter->p into a function whose early -EAGAIN return (old table freed after resize) left a stale pointer. Via __netlink_diag_dump(), reachable by unprivileged users, an attacker pauses a netlink diag dump, forces a resize, frees the socket at iter->p and reclaims it with a fake socket, obtaining a constrained 64-bit write through sock_diag_save_cookie() that was developed into stable LPE on Linux and Android with SELinux enforcing, without special kernel configuration or user namespaces. The fix (upstream commit 8173f7e2ce67) clears iter->p. Bug finders from NebuSec (Yuan Tan, Frank Wu) independently found it and supplied Linux and Android exploits.

Falcon / Antino (Unit 42): Falcon (aka XG, Xiang Ge) is a Node.js C2 framework that runs obfuscated JavaScript in victim browsers, delivered by injecting script tags into webmail (e.g. 39 Roundcube instances at a Middle Eastern foreign affairs ministry, April 2026) and government web apps, and by sideloading a Manifest V3 Chrome/Firefox extension named 'PDF Viewer' (ID mbidcmlcbgbphpoacojjbmfpohcimjji, 40 permissions). Unit 42 assesses with high confidence it is a variant of PeckBirdy (Trend Micro, Jan 2026). The implant talks over TLS WebSocket with RSA-negotiated AES-256-CBC, with an unencrypted Comet fallback; the panel listens on TCP 8080 and is revealed by pressing F9 three times; victim sessions use Baidu-Analytics-mimicking Hm_lvt_ identifiers. Capabilities include credential, cookie, autofill and history theft, browser-as-proxy session hijack, download replacement, clipboard replacement (wallet swapping), fetch/XHR hooking, Gmail, Discord, Zalo and X DM collection. The Rust implant Antino (earliest sample compiled 2025-10-06) uses Microsoft OneDrive via an OAuth app as C2 (antino/heartbeat/<BotID>.json, command_req_<BotID>_<ts>.json, antino/antino_upload/), is delivered through a fake Flash update from microsoft-flash.com, persists via a Scripted Diagnostic answer file abusing sdiagnhost.exe to write a Run key, and supports ten commands. Targets: government entities in one Middle Eastern and four Southeast Asian countries, March-May 2026. No actor is named.

GSocket (Microsoft): threat actors exploit internet-facing PHP applications, cPanel hosts (63.9% of incidents) and Apache (24.3%), run curl|bash installers from gsocket.io, stage gs-netcat in /dev/shm/.gs-0/, and persist with cron, systemd services with plausible names (defunct.service, systemd-remount-d) and shell startup files, so access survives patching of the original flaw. Traffic is relayed through the public Global Socket Relay Network, so there is no actor-owned IP or domain to block. Some intrusions attempted CVE-2026-43284 ('Dirty Frag') for root. Device detections rose 356.2% from March to August 2026; education and research (30.7%) and technology/telecom (22.9%) lead affected sectors.

Also covered in the roundup: CVE-2026-118737, an RPC Runtime remote code execution flaw (CVSS 8.1) with protections arriving from 2026-11-10 alongside NTLM signing hardening (KB5135557; NTLM signing required by default on servers from May 2027); and Sekoia's August 2026 honeypot observation of a suspected Chinese-speaking actor abusing legitimate Flowise functionality (credential enumeration, malicious 'System Status' chatflow with an HTTP Request beacon, LLM prompt abuse) rather than exploiting CVE-2025-59528 (CustomMCP RCE) or CVE-2026-41264 (CSV Agent RCE).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1070.006 Indicator Removal: Timestomp; T1218 System Binary Proxy Execution; T1564.001 Hide Artifacts: Hidden Files and Directories

Persistence

T1053.003 Scheduled Task/Job: Cron; T1176.001 Browser Extensions; T1543.002 Create or Modify System Process: Systemd Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1090.002 Proxy: External Proxy; T1102.002 Web Service: Bidirectional Communication; T1573.002 Encrypted Channel: Asymmetric Cryptography

Collection

T1185 Browser Session Hijacking

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1222.002 Linux and Mac Permissions

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Remediation

Patches

• Upstream Linux kernel commit 8173f7e2ce67 (CVE-2026-64563; fixes reported in 6.18.42 and 7.1.6 per OSV)
• Microsoft November 2026 security updates (CVE-2026-118737; KB5135557)
• Distribution kernel errata (Oracle Linux 8/9/10, Red Hat Bugzilla 2510892)

Immediate actions

• Apply Linux kernel updates containing the upstream rhashtable fix (commit 8173f7e2ce67) and fixes for the other seven MDASH LPE CVEs
• Apply Microsoft's November 2026 updates for CVE-2026-118737 (KB5135557 delivers NTLM signing improvements)
• Hunt Linux web servers for GSocket artifacts: /dev/shm/.gs-*, systemd-remount-d, .gsn_ora, defunct, defunct.service, and curl/bash installs from gsocket.io or gsgg.b-cdn.net
• Block or alert on outbound access to gsocket.io, cdn.gsocket.io and gsgg.b-cdn.net, and on Falcon domains fonts.tarotfree101.top, fonts.chrorne.com, robot.avbliud.com, microsoft-flash.com, wps-cn.com
• Remove the Falcon 'PDF Viewer' extension ID mbidcmlcbgbphpoacojjbmfpohcimjji and rotate credentials and sessions of affected users

Workarounds

• Look for Hm_lvt_ cookies or local storage on internal sites, where Baidu Analytics has no legitimate presence
• Alert on script tags on internal webmail or ticketing portals loading from unfamiliar domains
• Prioritize privilege-escalation patching (including CVE-2026-43284) on internet-facing Linux servers

Longer-term hardening

• Treat GSocket removal as host remediation, not just application patching: audit cron, systemd units and shell startup files
• Enforce deny-by-default egress on internet-facing Linux servers and mount /tmp and /dev/shm non-executable where feasible
• Block developer-mode/sideloaded browser extensions requesting <all_urls>, debugger, nativeMessaging or webRequest via enterprise policy
• Monitor OAuth activity to OneDrive tenants outside the organization and small repeated JSON writes to antino/ paths
• Do not expose AI orchestration platforms such as Flowise to the internet; restrict credentials and outbound HTTP nodes
• Prepare for NTLM signing being required by default on Windows servers from May 2027

Affected and fixed versions

• Linux — Linux kernel (rhashtable, net/ipv4, net/ipv6, net/xfrm, drivers/net GTP, security/keys), including Android
  Vulnerable versions: Per OSV: introduced 4.18.0 (one range) / 6.19.0 (another range) for CVE-2026-64563
  Fixed in: 6.18.42; 7.1.6
• Microsoft — Windows RPC Runtime (CVE-2026-118737)
  Vulnerable versions: See MSRC advisory
  Fixed in: November 2026 updates (KB5135557)
• FlowiseAI — Flowise (CVE-2025-59528 CustomMCP, CVE-2026-41264 CSV Agent)
  Vulnerable versions: Not stated in source
  Fixed in: Not stated in source
• Various — PHP web applications, cPanel hosts and Apache servers targeted for GSocket persistence; Roundcube webmail and government web apps targeted by Falcon

Timeline

• 2025-10-06 Earliest known Antino (Rust, OneDrive C2) sample compiled, per Unit 42
• 2026-03-01 Microsoft's March-August 2026 window begins, over which GSocket-related device detections rose 356.2% on PHP, cPanel and Apache hosts
• 2026-04-23 Falcon operator uploads installer tools firefox.zip (April 23) and browser.exe (April 25) to the panel; Roundcube webmail of a Middle Eastern foreign affairs ministry compromised in April
• 2026-05-20 Microsoft begins MDASH scan of Linux kernel subsystems (late May through mid-June 2026; 26,502 raw findings)
• 2026-06-27 First public upstream Linux kernel report from the MDASH effort sent
• 2026-08-25 Sekoia honeypot observes suspected Chinese-speaking actor abusing Flowise features (late August 2026; date approximate)
• 2026-09-01 55 of 59 MDASH kernel reports public; the remaining four routed to public lists by mid-October
• 2026-09-07 Sekoia distributes original private FLINT report on the Flowise activity
• 2026-10-19 Sekoia publishes the Flowise honeypot blog publicly
• 2026-11-10 Microsoft November updates begin addressing CVE-2026-118737 and ship NTLM signing improvements (KB5135557)
• 2026-11-11 Microsoft publishes 'Lessons from 59 Linux kernel bug reports' and the GSocket threat report
• 2026-11-12 The Hacker News ThreatsDay bulletin summarizes the kernel, Falcon, GSocket, RPC and Flowise items

Sources cited

• MSRC: CVE-2026-118737 Microsoft Security Response Center · Advisory · 2026-11-10
• CVE-2026-64563 - NVD NVD (NIST) · Advisory
• Red Hat Bugzilla 2510892: CVE-2026-64563 rhashtable: clear stale iter->p on table restart bugzilla.redhat.com · Advisory
• OSV: CVE-2026-64563 osv.dev · Advisory
• Lessons from 59 Linux kernel bug reports (Microsoft) Microsoft · Vendor report · 2026-11-11
• Global Socket: how threat actors are weaponizing GSocket for stealthy C2 (Microsoft) Microsoft · Vendor report · 2026-11-11
• Falcon C2 browser compromise (Unit 42) Unit 42 · Research
• A honeypot's tale: deconstructing an attack on GenAI infrastructure (Sekoia) sekoia.com · Research · 2026-10-19
• KB5135557: NTLM signing security improvements Microsoft · Vendor report · 2026-11-10
• GSocket (hackerschoice) open-source repository GitHub · Code repository
• ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories The Hacker News · News · 2026-11-12
• Microsoft's MDASH AI system finds 16 vulnerabilities (The Hacker News) The Hacker News · News
• China-linked hackers PeckBirdy (The Hacker News) The Hacker News · News

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Other reports on CVE-2026-64563

• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs

Other reports on CVE-2026-118737

• Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194)
• Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Exploited to Steal NTLM Hashes (1,235 Flaws Fixed)

Previous and next in vulnerability

• Citrix Patches 12 NetScaler ADC/Gateway/Console and Secure Access Client Flaws, Including Authentication Bypass (CVE-2026-120869) Previous report
• CVE-2025-13902: Authenticated Cross-Site Scripting (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controller Web Server (Claroty also lists M262) Next report