[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3-SyG4yww5j80e71taRJTBFW1-xHz5lS99imLybNmzE":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"84d02fa8-48c7-42fb-ad35-0832fe081766","Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching","microsoft-warns-hackers-are-using-gsocket-backdoors-to-keep-linux-servers-compro-d79655","Microsoft has warned that attackers are using a free remote access tool called GSocket to stay inside Linux servers even after the original security hole is fixed. Many admins treat a patch as the end of an incident, but this activity shows that patching alone may leave the attacker’s access untouched. GSocket is an open […] The post Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching appeared first on Cyber Security News.","Microsoft warns that attackers are leveraging the open-source tool GSocket as a backdoor to maintain persistent access to Linux servers, even after the initial vulnerability has been patched. Attackers exploit flaws in web applications, download and run GSocket, which then connects to a public relay network, hiding traffic and bypassing traditional security measures. This allows them to retain access without needing open ports or public IPs, making traditional blocking methods ineffective.","Hackers use GSocket backdoor to maintain Linux server access post-patching.","https:\u002F\u002Fcybersecuritynews.com\u002Fgsocket-backdoors\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMicrosoft-Warns-Hackers-Are-Using-GSocket-Backdoors-to-Keep-Linux-Servers-Compromised-After-Patching.webp","2026-11-12T09:44:00+00:00","2026-11-12T10:00:27.549641+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"GSocket","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Linux","technology",{"name":27,"type":25},"PHP",{"name":29,"type":25},"cPanel",{"name":31,"type":25},"Apache","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,58],{"type":36,"value":18,"context":57},"Remote access tool used as a backdoor",{"type":59,"value":60,"context":61},"cve","CVE-2026-43284","Linux kernel bug exploited in some cases for root access",[21,18],{"controls":64,"vendors":152},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"patch-management","Automated patch management","Known holes get closed in days, not months.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":124,"name":125,"problem":126,"products":127},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[153],{"slug":154,"name":21,"logo_path":155,"roles":156},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":168},"gsocket-backdoors-survive-patching-persistence-is-the-real-threat","GSocket Backdoors Survive Patching — Persistence Is the Real Threat","Patching a vulnerability is not the same as fully remediating a compromise. In this campaign, attackers exploited web application flaws to install GSocket, an open-source relay tool, before patches were applied — and the backdoor persisted even after the underlying flaw was fixed. Because GSocket tunnels traffic through a public relay network without requiring open ports or public IPs, it evades firewall-based blocking and blends into normal outbound traffic. This highlights a critical gap in many incident response procedures: teams close the initial vulnerability but fail to verify whether the system was already compromised and cleaned. The lesson is that patching must be paired with thorough post-exploitation forensics and persistent egress traffic monitoring.",[163,164,165,166,167],"MITRE ATT&CK T1505: Server Software Component","MITRE ATT&CK T1572: Protocol Tunneling","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 SI-4: System Monitoring","CIS Control 13: Network Monitoring and Defense",{"MITRE ATT&CK T1572: Protocol Tunneling":169,"NIST SP 800-53 IR-4: Incident Handling":170,"NIST SP 800-53 SI-4: System Monitoring":171,"MITRE ATT&CK T1505: Server Software Component":172,"CIS Control 13: Network Monitoring and Defense":173},"GSocket tunnels attacker command-and-control traffic through a public relay network, which is exactly the technique ATT&CK T1572 describes for evading network-based detection and blocking.","IR-4 requires organizations to contain, eradicate, and recover from incidents fully — a requirement that was not met because the backdoor persisted after patching without an eradication step.","SI-4 requires continuous monitoring for unauthorized activity, including anomalous outbound connections, which would have been necessary to detect GSocket's relay traffic after the initial vulnerability was patched.","GSocket was installed as a persistent backdoor on web-facing Linux servers, matching ATT&CK's category of adversaries implanting server-side components to maintain long-term access.","CIS Control 13 specifically calls for monitoring and analyzing network traffic for malicious or anomalous behavior, which is the primary technical control that would detect GSocket's outbound relay tunneling."]