The global socket: how threat actors are weaponizing GSocket for stealthy C2

Threat actors are exploiting web application vulnerabilities to deploy GSocket, an open-source tool that tunnels command-and-control traffic through a public relay network, allowing attackers to maintain persistent access even after the original vulnerability is patched. This highlights a critical gap in incident response: remediating the initial vulnerability without thoroughly investigating and evicting any implants left behind gives attackers a lasting foothold. Because GSocket uses a legitimate public relay rather than attacker-owned infrastructure, traditional network-based detection of suspicious C2 domains or IPs is largely ineffective. Organizations that lack robust endpoint telemetry and behavioral monitoring on Linux servers will likely miss this persistence mechanism entirely, leaving themselves exposed long after they believe the incident is resolved.