Threat actors abuse GSocket for persistent Linux server access

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Linux servers compromised by threat actors using GSocket

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild

What to do

The Brief

Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, on Linux servers.
Attackers use GSocket to keep access after the vulnerabilities used for initial access have been patched.

Patching the initial entry point may not remove an attacker's access if GSocket has already been installed on the server.

Checklist · 2 of 10 yes

Yes	Hits tech teams	Judgment: Linux servers that ops and IT teams run are affected by the GSocket persistence.
No	Core infrastructure	Judgment: GSocket is a niche open-source remote access tool, not core infrastructure like OpenSSH or the Linux kernel.
No	Popular tool	Judgment: GSocket is a niche tool, not a widely used mainstream framework or platform.
Yes	Exploited in the wild	BleepingComputer: multiple threat actors are abusing GSocket to maintain access to Linux servers.
No	Public exploit	BleepingComputer: no published exploit code or proof-of-concept is mentioned in the source.
No	Remote, no login	BleepingComputer: no unauthenticated network attack vector is described; access follows earlier initial compromise.
No	Full takeover	BleepingComputer: describes persistent access to servers; no explicit root, RCE or admin takeover is stated.
No	Secrets exposed	BleepingComputer: no stolen credentials, keys, configs or data exposure is reported.
No	Supply chain	BleepingComputer: GSocket is a legitimate tool abused by attackers; no compromised package or update is reported.
No	No fix yet	BleepingComputer: the source refers to patching the initially exploited vulnerabilities, implying fixes exist.

First seen 2h ago · 1 source · Full story page · How tiers are decided