Attackers use GSocket relays to retain access to Linux servers

Multiple threat actors are using the legitimate GSocket remote access tool to retain access to Linux servers after initial vulnerabilities are patched, BleepingComputer reported, citing Microsoft research. Microsoft Defender for Endpoint detections increased by 356.2% between March and August. Both the attacker and compromised server connect outward to a relay that brokers an encrypted session. This avoids an inbound listener and makes IP- or domain-based access controls harder to use against the connection. Attackers disguised GSocket as kernel threads and established persistence through cron jobs, systemd services and shell startup files. Microsoft said inbound firewall rules do not catch the traffic, while outbound monitoring and filtering can. Administrators should remove associated files and verify relay connections have stopped.