GSocket abused to keep access to Linux servers after patching
Attackers abuse the open-source GSocket tool to keep access to Linux servers even after the flaw is patched. What to check on one machine and how to respond.
TL;DR: Attackers are misusing GSocket, a genuine free remote-access utility, to stay on Linux servers even after the original hole is patched. Patching alone does not end a compromise: if a server was exposed, look for the tool too.
What happened
BleepingComputer reported that several threat actors are planting GSocket on Linux servers. GSocket is not malware in itself: it is an authentic public utility for reaching machines remotely, which is why it can blend in with normal administration. The attackers use it to keep a way back into a machine, so the access survives after the vulnerability that let them in has been fixed.
The lesson for defenders is simple. A patch closes the door that was used, but it does not remove anything left inside. If a server ran a vulnerable, internet-facing service before you patched it, treat the patch as the first step, not the last.
Am I affected?
Any Linux server that was reachable with an unpatched flaw is a candidate. A short manual review on one machine:
- List running processes and listening or outbound connections, and look for remote access tools nobody installed on purpose.
- Check scheduled jobs, systemd units and shell start-up files for entries you do not recognise.
- Compare installed software and its files against a known-good build or image.
- If you find the tool, isolate the host, rotate the credentials and keys it could reach, and rebuild from a clean image rather than cleaning it by hand.
How to check with Stackurity
Stackurity does not hunt for implants or detect remote access tools, and it is not an intrusion detection product. What it helps with is the cause: one live inventory of the software on your Linux servers, matched against new advisories and the CISA Known Exploited Vulnerabilities catalogue every hour, so exposed hosts get patched quickly, and a check after the fix records whether the issue is really gone. It also finds keys and passwords written in files, which is useful when you need to rotate credentials after an incident. Read how remediation works. Stackurity Cloud has a 14-day trial: start a free trial.
