Date: 11/12/2026
Severity: High
Summary
Researchers identified multiple threat actors abusing GSocket, an open-source remote access tool, to establish stealthy Command-and-Control (C2), reverse shell access, and Remote Code Execution (RCE) on compromised Linux servers following the exploitation of internet-facing web applications. Attackers deploy GSocket through remote scripts and leverage shared relay infrastructure and encrypted outbound connections to maintain covert access while evading network-based detection. The intrusions also involve process masquerading, hidden payload staging, cron jobs, and systemd services for defense evasion and persistence, alongside attempted Linux privilege escalation using CVE-2026-43284 (Dirty Frag). The activity highlights the abuse of legitimate remote access tools for covert access, persistence, and post-exploitation operations.
Indicators of Compromise (IOC) List
Domains/URLs | https://cdn.gsocket.io/bin/gs-netcat_mini-linux-aarch64 https://gsgg.b-cdn.net/bin/gs-netcat_mini-linux-x86_64 https://gsocket.io/install.sh https://gsocket.io/y gsocket.io cdn.gsocket.io gsgg.b-cdn.net |
Hash | 12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c
55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f
d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa
f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5
|
File Path | /dev/shm/.gs-0/gs-netcat_mini-linux-x86_64 /dev/shm/.gs-0/gs-netcat_mini-linux-aarch64 /tmp/systemd-remount-d /usr/bin/systemd-remount-d /tmp/.gsn_ora |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://cdn.gsocket.io/bin/gs-netcat_mini-linux-aarch64" or url like "https://cdn.gsocket.io/bin/gs-netcat_mini-linux-aarch64" or siteurl like "https://cdn.gsocket.io/bin/gs-netcat_mini-linux-aarch64" or domainname like "gsgg.b-cdn.net" or url like "gsgg.b-cdn.net" or siteurl like "gsgg.b-cdn.net" or domainname like "https://gsocket.io/install.sh" or url like "https://gsocket.io/install.sh" or siteurl like "https://gsocket.io/install.sh" or domainname like "cdn.gsocket.io" or url like "cdn.gsocket.io" or siteurl like "cdn.gsocket.io" or domainname like "gsocket.io" or url like "gsocket.io" or siteurl like "gsocket.io" or domainname like "https://gsgg.b-cdn.net/bin/gs-netcat_mini-linux-x86_64" or url like "https://gsgg.b-cdn.net/bin/gs-netcat_mini-linux-x86_64" or siteurl like "https://gsgg.b-cdn.net/bin/gs-netcat_mini-linux-x86_64" or domainname like "https://gsocket.io/y" or url like "https://gsocket.io/y" or siteurl like "https://gsocket.io/y" |
Detection Query 2 : | sha256hash IN ("f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5","d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa","55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f","12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c")
|
Detection Query 3 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "/dev/shm/.gs-0/gs-netcat_mini-linux-x86_64" or objectname like "/dev/shm/.gs-0/gs-netcat_mini-linux-aarch64" or objectname like "/tmp/systemd-remount-d" or objectname like "/usr/bin/systemd-remount-d" or objectname like "/tmp/.gsn_ora") |
Detection Query 3 : | technologygroup = "EDR" and (objectname like "/dev/shm/.gs-0/gs-netcat_mini-linux-x86_64" or objectname like "/dev/shm/.gs-0/gs-netcat_mini-linux-aarch64" or objectname like "/tmp/systemd-remount-d" or objectname like "/usr/bin/systemd-remount-d" or objectname like "/tmp/.gsn_ora") |
Reference:
How Threat Actors are Weaponizing GSocket for Stealthy C2