# ThreatsDay Roundup: Microsoft MDASH Linux Kernel Bugs (CVE-2026-64563), Falcon Browser Spyware, GSocket Backdoors

> The Hacker News ThreatsDay bulletin (2026-11-12) rolls up Microsoft's MDASH-driven Linux kernel bug reports (CVE-2026-64563 rhashtable use-after-free giving local root, incl. Android with SELinux enforcing), Unit 42's Falcon JavaScript browser C2 framework with the OneDrive-based Antino implant targeting government entities, and Microsoft's report of GSocket used as post-patch persistence on Linux web servers (+356.2% device detections Mar-Aug 2026).

- **Published:** 2026-11-12T18:51:07Z
- **Last reviewed:** 2026-11-12T18:51:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5881
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5881.png
- **ID:** TL-2026-5881
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)
- **CVEs:** CVE-2026-64563, CVE-2026-118737, CVE-2025-59528, CVE-2026-41264, CVE-2026-64554, CVE-2026-64580, CVE-2026-74561, CVE-2026-74562, CVE-2026-89789, CVE-2026-98222, CVE-2026-98364, CVE-2026-43284

## Description

This record tracks a multi-item roundup. Authoritative detail comes from the primary vendor reports cited below; CVSS is not stated by the source for CVE-2026-64563, so cvss_score is left null (third-party trackers list 7.8 preliminarily, unconfirmed by NVD in this research).

Kernel: Microsoft's FORGE Lab used an AI-assisted pipeline (MDASH) to scan a subset of Linux kernel subsystems from late May to mid-June 2026, yielding 26,502 raw findings, 621 PoC-backed cases, 59 upstream reports and 33 assigned CVEs, 24 rated High or above. Working local root privilege-escalation exploits were confirmed in the lab for eight CVEs (CVE-2026-64554, -64563, -64580, -74561, -74562, -89789, -98222, -98364), spanning net/ipv4, net/ipv6, net/xfrm, drivers/net (GTP), security/keys and lib/rhashtable. CVE-2026-64563 is a use-after-free in rhashtable_walk_start_check(): a 2018 commit (5d240a8936f6) moved the reset of iter->p into a function whose early -EAGAIN return (old table freed after resize) left a stale pointer. Via __netlink_diag_dump(), reachable by unprivileged users, an attacker pauses a netlink diag dump, forces a resize, frees the socket at iter->p and reclaims it with a fake socket, obtaining a constrained 64-bit write through sock_diag_save_cookie() that was developed into stable LPE on Linux and Android with SELinux enforcing, without special kernel configuration or user namespaces. The fix (upstream commit 8173f7e2ce67) clears iter->p. Bug finders from NebuSec (Yuan Tan, Frank Wu) independently found it and supplied Linux and Android exploits.

Falcon / Antino (Unit 42): Falcon (aka XG, Xiang Ge) is a Node.js C2 framework that runs obfuscated JavaScript in victim browsers, delivered by injecting script tags into webmail (e.g. 39 Roundcube instances at a Middle Eastern foreign affairs ministry, April 2026) and government web apps, and by sideloading a Manifest V3 Chrome/Firefox extension named 'PDF Viewer' (ID mbidcmlcbgbphpoacojjbmfpohcimjji, 40 permissions). Unit 42 assesses with high confidence it is a variant of PeckBirdy (Trend Micro, Jan 2026). The implant talks over TLS WebSocket with RSA-negotiated AES-256-CBC, with an unencrypted Comet fallback; the panel listens on TCP 8080 and is revealed by pressing F9 three times; victim sessions use Baidu-Analytics-mimicking Hm_lvt_ identifiers. Capabilities include credential, cookie, autofill and history theft, browser-as-proxy session hijack, download replacement, clipboard replacement (wallet swapping), fetch/XHR hooking, Gmail, Discord, Zalo and X DM collection. The Rust implant Antino (earliest sample compiled 2025-10-06) uses Microsoft OneDrive via an OAuth app as C2 (antino/heartbeat/<BotID>.json, command_req_<BotID>_<ts>.json, antino/antino_upload/), is delivered through a fake Flash update from microsoft-flash.com, persists via a Scripted Diagnostic answer file abusing sdiagnhost.exe to write a Run key, and supports ten commands. Targets: government entities in one Middle Eastern and four Southeast Asian countries, March-May 2026. No actor is named.

GSocket (Microsoft): threat actors exploit internet-facing PHP applications, cPanel hosts (63.9% of incidents) and Apache (24.3%), run curl|bash installers from gsocket.io, stage gs-netcat in /dev/shm/.gs-0/, and persist with cron, systemd services with plausible names (defunct.service, systemd-remount-d) and shell startup files, so access survives patching of the original flaw. Traffic is relayed through the public Global Socket Relay Network, so there is no actor-owned IP or domain to block. Some intrusions attempted CVE-2026-43284 ('Dirty Frag') for root. Device detections rose 356.2% from March to August 2026; education and research (30.7%) and technology/telecom (22.9%) lead affected sectors.

Also covered in the roundup: CVE-2026-118737, an RPC Runtime remote code execution flaw (CVSS 8.1) with protections arriving from 2026-11-10 alongside NTLM signing hardening (KB5135557; NTLM signing required by default on servers from May 2027); and Sekoia's August 2026 honeypot observation of a suspected Chinese-speaking actor abusing legitimate Flowise functionality (credential enumeration, malicious 'System Status' chatflow with an HTTP Request beacon, LLM prompt abuse) rather than exploiting CVE-2025-59528 (CustomMCP RCE) or CVE-2026-41264 (CSV Agent RCE).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204.002 User Execution: Malicious File
- T1053.003 Scheduled Task/Job: Cron
- T1543.002 Create or Modify System Process: Systemd Service
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1176.001 Browser Extensions
- T1036 Masquerading
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1222.002 Linux and Mac Permissions
- T1070.006 Indicator Removal: Timestomp
- T1070.004 Indicator Removal: File Deletion
- T1218 System Binary Proxy Execution
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1185 Browser Session Hijacking
- T1090.002 Proxy: External Proxy
- T1102.002 Web Service: Bidirectional Communication
- T1573.002 Encrypted Channel: Asymmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GSocket Persistence and Staging Artifacts: cron, systemd, Shell Startup (Post-Exploitation)** (`TL-2026-5881-SPL-002`)

Detects the Microsoft-reported GSocket artifacts: gs-netcat staged under /dev/shm/.gs-0/, the /tmp/.gsn_ora payload, binaries masquerading as systemd-remount-d or /usr/bin/defunct (launched with exec -a [kaluad]) and the defunct.service unit. Also flags cron, systemd or shell-startup files written by a process running out of /dev/shm, /tmp or /var/tmp, the persistence methods that let GSocket survive patching of the original flaw (TL-2026-5881).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.003, T1543.002, T1036, T1564.001
- **Data sources:** sysmon_for_linux (index=linux, sourcetype=sysmon:linux, EventID 1 and 11), microsoft_defender_for_endpoint (DeviceProcessEvents, DeviceFileEvents), linux_file_event
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventID IN (1, 11) earliest=-24h
| eval artifact=coalesce(TargetFilename, CommandLine), creator=coalesce(Image, "unknown")
| eval gsocket_artifact=if(match(artifact, "(?i)(/dev/shm/[.]gs-|[.]gsn_ora|systemd-remount-d|/usr/bin/defunct|defunct[.]service|kaluad|gs-netcat)"), 1, 0)
| eval persist_from_tmp=if(match(artifact, "(?i)(^/etc/cron|^/var/spool/cron|^/etc/systemd/system/|^/usr/lib/systemd/system/|[.]bashrc$|[.]profile$|[.]bash_profile$|[.]zshrc$)") AND match(creator, "^(/dev/shm|/tmp|/var/tmp)/"), 1, 0)
| where gsocket_artifact=1 OR persist_from_tmp=1
| eval persistence_type=case(match(artifact, "(?i)[.]service"), "systemd_service", match(artifact, "(?i)cron"), "cron", match(artifact, "(?i)(bashrc|profile|zshrc)"), "shell_startup", true(), "staging_or_masquerade")
| stats count min(_time) as first_seen max(_time) as last_seen values(artifact) as artifacts values(creator) as creators by host User persistence_type
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let gs_regex = @'(?i)(/dev/shm/[.]gs-|[.]gsn_ora|systemd-remount-d|/usr/bin/defunct|defunct[.]service|kaluad|gs-netcat)';
let persist_regex = @'(?i)(^/etc/cron|^/var/spool/cron|^/etc/systemd/system/|^/usr/lib/systemd/system/|[.]bashrc$|[.]profile$|[.]bash_profile$|[.]zshrc$)';
let proc_hits = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine matches regex gs_regex
    | project Timestamp, DeviceName, AccountName, Signal='process_cmdline', Artifact=ProcessCommandLine, Actor=InitiatingProcessFileName;
let file_hits = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ('FileCreated','FileModified','FileRenamed')
    | where FolderPath matches regex gs_regex or (FolderPath matches regex persist_regex and InitiatingProcessFolderPath matches regex @'^/(dev/shm|tmp|var/tmp)/')
    | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Signal='file_event', Artifact=FolderPath, Actor=InitiatingProcessFolderPath;
union proc_hits, file_hits
| order by Timestamp desc
```

### Sigma

```yaml
title: GSocket Persistence and Staging Artifacts on Linux
id: 7b2d9e14-5a3c-4f68-8c0b-2e91d4a6f302
status: experimental
description: Detects creation of GSocket (gs-netcat) artifacts such as /dev/shm/.gs-0, .gsn_ora, systemd-remount-d, /usr/bin/defunct and defunct.service, and cron, systemd or shell startup files written by a process running from /dev/shm, /tmp or /var/tmp (TL-2026-5881).
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.persistence
    - attack.t1053.003
    - attack.t1543.002
    - attack.defense-evasion
    - attack.t1036
    - attack.t1564.001
logsource:
    category: file_event
    product: linux
detection:
    selection_gs:
        TargetFilename|contains:
            - '/dev/shm/.gs-'
            - '.gsn_ora'
            - 'systemd-remount-d'
            - '/usr/bin/defunct'
            - 'defunct.service'
    selection_persist_path:
        TargetFilename|startswith:
            - '/etc/cron'
            - '/var/spool/cron'
            - '/etc/systemd/system/'
            - '/usr/lib/systemd/system/'
    selection_persist_startup:
        TargetFilename|endswith:
            - '/.bashrc'
            - '/.profile'
            - '/.bash_profile'
            - '/.zshrc'
    selection_staging_image:
        Image|startswith:
            - '/dev/shm/'
            - '/tmp/'
            - '/var/tmp/'
    condition: selection_gs or ((selection_persist_path or selection_persist_startup) and selection_staging_image)
falsepositives:
    - Administrators running self-extracting installers from /tmp that register a service or cron job
    - Authorized use of GSocket for remote administration
level: high
```

**Known false positives:**

- Self-extracting software installers that run from /tmp and register a cron job or systemd unit
- Authorized administrators using GSocket for legitimate remote access

**Tuning notes:** Allowlist known installer paths and configuration-management accounts in the persist_from_tmp arm. The named-artifact arm (.gs-0, .gsn_ora, defunct.service, systemd-remount-d) is high fidelity and should alert without tuning. Ensure Sysmon for Linux logs FileCreate (EventID 11) for /etc/cron*, /etc/systemd and home-directory startup files.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Root Shell Spawned from User-Writable Path Without sudo/su (Linux Kernel LPE, CVE-2026-64563 Family) (locked: unlock with TL Creds)
- Antino Persistence via sdiagnhost.exe Scripted Diagnostic and Run Key (Post-Exploitation) (locked: unlock with TL Creds)
- Antino OneDrive/Microsoft Graph C2 from Non-Browser Process in User-Writable Path (C2) (locked: unlock with TL Creds)
- Falcon Malicious Browser Extension and Fake Flash Installer Dropped to Disk (Exploitation) (locked: unlock with TL Creds)
- Execution from Hidden /dev/shm Directory and Process-Name Masquerade (Post-Exploitation) (locked: unlock with TL Creds)
- GSocket Relay C2: Outbound Connection from Staged or Masqueraded gs-netcat Binary (C2) (locked: unlock with TL Creds)
- GSocket Installer or curl-pipe-shell Spawned by Web Server Process (Exploitation) (locked: unlock with TL Creds)
- Web and Proxy Access to Falcon, Antino Delivery, GSocket and Flowise Beacon Infrastructure (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `154.217.251[.]226`
- Domain: `fonts[.]tarotfree101[.]top`
- File hash: `0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories](https://thehackernews.com/2026/11/threatsday-59-linux-kernel-bugs-falcon.html)
- [Lessons from 59 Linux kernel bug reports (Microsoft)](https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/)
- [Global Socket: how threat actors are weaponizing GSocket for stealthy C2 (Microsoft)](https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/)
- [Falcon C2 browser compromise (Unit 42)](https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/)
- [A honeypot's tale: deconstructing an attack on GenAI infrastructure (Sekoia)](https://www.sekoia.com/blog/a-honeypots-tale-deconstructing-an-attack-on-genai-infrastructure)
- [MSRC: CVE-2026-118737](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118737)
- [KB5135557: NTLM signing security improvements](https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/11/kb5135557-ntlm-signing-security-improvements)
- [CVE-2026-64563 - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-64563)
- [Red Hat Bugzilla 2510892: CVE-2026-64563 rhashtable: clear stale iter->p on table restart](https://bugzilla.redhat.com/show_bug.cgi?id=2510892)
- [OSV: CVE-2026-64563](https://osv.dev/vulnerability/CVE-2026-64563)
- [Microsoft's MDASH AI system finds 16 vulnerabilities (The Hacker News)](https://thehackernews.com/2026/05/microsofts-mdash-ai-system-finds-16.html)
- [China-linked hackers PeckBirdy (The Hacker News)](https://thehackernews.com/2026/01/china-linked-hackers-have-used.html)
- [GSocket (hackerschoice) open-source repository](https://github.com/hackerschoice/gsocket)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5881