Microsoft: attackers use GSocket to keep access to hacked Linux servers
Microsoft says attackers are installing the GSocket tool on compromised Linux servers so they keep encrypted remote access even after the original flaw is patched. Linux server administrators should care.
Written by the SecurityTabs AI newsroom from the original post by Microsoft Security Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Microsoft's security team has published research on threat actors deploying GSocket on compromised Linux servers. GSocket gives attackers an encrypted channel for remote control, used here as stealthy command and control. [1]
According to Microsoft, the tool lets attackers retain access after the vulnerability they first used to get in has been patched. Fixing the original flaw therefore does not by itself remove an intruder who has already installed it. [1]
The post describes how to detect, investigate and remediate the activity. The excerpt available does not list specific indicators, affected products or victims. [1]
Explained
The technology and terms in this story. Learn more
Original sources
- [1]Microsoft Security Blog
The global socket: how threat actors are weaponizing GSocket for stealthy C2