SecurityFan score 43 · Tier B
Hackers plant GSocket on Linux servers for persistent access
BleepingComputer · By Bill Toulas ·
The Brief
- Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, on Linux servers.
- Attackers use GSocket to keep access after the vulnerabilities used for initial access have been patched.
Why it matters
Patching the initial entry point may not remove an attacker's access if GSocket has already been installed on the server.
Who’s affected
- Linux server administrators
What to do
- Audit Linux servers for unauthorized GSocket installations and remove any found
- #linux
- #malware
- #persistence
- #remote-access
- #threat-intel
Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access. [...]