Hackers Are Using a Legitimate Remote Access Tool to Stay on Linux Servers After They Are Patched

Patching a compromised Linux server can close the hole attackers used while leaving their connection running. Microsoft reported on November 11 that intruders are installing GSocket, an open source remote access tool, to keep access after the original application vulnerability is fixed.

The tool runs separately from the vulnerable application. That makes the application patch only part of the cleanup.

A public relay does the connecting

GSocket has legitimate uses. Its own documentation describes a toolkit that connects computers behind firewalls or network address translation through a public relay network. The endpoints use a shared secret to find each other, then establish an encrypted connection.

That design removes the need for either computer to know the other's IP address. It also means an investigator looking only for a dedicated attacker server can miss how the connection works. The relay carries the traffic; the tool supplies the remote access.

Microsoft found attackers concealing processes and adding persistence through mechanisms including scheduled jobs and system services. Closing the initial entry point does not remove those changes.

A detection increase, with a specific base

Devices with GSocket-related detections rose 356.2% between March and August 2026 in Microsoft Defender for Endpoint telemetry. That measures detections in Microsoft's data, rather than a count of every compromised Linux server.

The defensive consequence is broader than installing an update. Microsoft calls for investigating the relay client, removing persistence and checking that outbound relay connections stop. Organizations can also restrict access to the shared relay infrastructure.

A patched application can therefore coexist with an intruder who still has a way back in. The fix has to reach the host as well as the software that first let them through.

Some offers on this page may be paid placements or contain affiliate links.