Covered by 2 outlets — first reported by Microsoft Security Blog, Nov 11, 19:49 UTC
The global socket: how threat actors are weaponizing GSocket for stealthy C2
MentionsMicrosoft
In brief
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity.
From Microsoft Security Blog's coverage.
Continue reading
2 outlets, in the order they reported it.
Microsoft Security BlogFirst report
The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity.
BleepingComputer
Hackers plant GSocket on Linux servers for persistent access
Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access.
Explained
The technology and terms in this story. Learn more