The global socket: how threat actors are weaponizing GSocket for stealthy C2

Reported by Microsoft Security (Yash Gund, Sumith Maniath and Microsoft Security Research)

Summary by Cyber Security News11 Nov 2026, 20:49 CET

About this summary. This is a short excerpt from the description that Microsoft Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/

When one RCE stops being just one RCE Observed attack chains How threat actors deploy and operate GSocket How GSocket reconnects without a fixed C2 address Mitigation and protection guidance References Learn More Microsoft observed multiple incidents in which threat actors deployed GSocket, an open source remote access tool, on compromised Linux servers. Threat actors used Gsocket to maintain access even after the vulnerabilities used for initial compromise were remediated.

Read the full article at Microsoft Security →

Source attribution: headline and facts are from Microsoft Security (microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.