Threat Actors Abuse GSocket for Persistent Access on Compromised Linux Servers

# Threat Actors Abuse GSocket for Persistent Access on Compromised Linux Servers

https://gcdradar.vercel.app/incidents/threat-actors-abuse-gsocket-for-persistent-access-on-comprom · AIR-2026-1924 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world usage by threat actors for persistence.
- Fix status: No fix needed
- First reported: 2026-11-12
- AI role: No AI role
- Products: GSocket

## Summary

Multiple threat actors are actively abusing the legitimate GSocket tool to maintain persistent access on compromised Linux servers. The technique allows attackers to retain control even after underlying initial access vulnerabilities are patched.

## What to do

Audit Linux servers for unauthorized GSocket installations and inspect network connections.

## Latest updates

- 2026-11-12: Hackers plant GSocket on Linux servers for persistent access (https://bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access)

## Sources

- 2026-11-12 BleepingComputer: Hackers plant GSocket on Linux servers for persistent access https://bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access
- 2026-11-12 The Hacker News: ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories https://thehackernews.com/2026/11/threatsday-59-linux-kernel-bugs-falcon.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.