{"id":"CMP-202611-mjx37p","kind":"campaign","aliases":[],"related":[],"title":"Attackers break into Linux web servers (PHP, cPanel, Apache) and install GSocket, a relay-based remote access tool that keeps them in after the hole is patched (Microsoft)","description":null,"summary":"Microsoft reports multiple incidents, by several unrelated attackers, in which a hacked internet-facing web application on Linux is used to download a script with curl that installs GSocket (gs-netcat), an open source remote access tool. It connects outbound through the public Global Socket Relay Network, so there is no attacker IP or domain to block, and it stays after the original flaw is patched. Some attackers also tried the Linux kernel flaw CVE-2026-43284 (Dirty Frag) to get root. Microsoft Defender detections rose 356% from March to August 2026. 87% of incidents were web apps and hosting: PHP web apps and cPanel hosting 64%, Apache 24%. Most hit sectors: education and research (31%), then technology and telecoms (23%). Which web app flaws were used for the first break-in: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-11T20:44:07+00:00","products":[{"name":"GSocket","fixed":[]},{"name":"cPanel","fixed":[]},{"name":"Apache HTTP Server","fixed":[]},{"name":"PHP","fixed":[]},{"name":"Linux kernel","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"On internet-facing Linux servers, look for: a GSocket / gs-netcat binary, especially one staged in /dev/shm or another writable or memory-backed path; processes with kernel-thread-like names (e.g. in brackets) that are really user-space binaries run by the web server user; new cron entries, systemd units, shell profile lines (.bashrc/.profile) or watchdog scripts that start it; env vars GS_TG_TOKEN / GS_TG_CHATID (Telegram delivery of the secret); outbound connections to the Global Socket Relay Network (gsocket relay); shells or curl run as children of PHP/Apache/web server processes. Microsoft Defender alerts: 'GsNetcat' hacktool, 'Suspicious shell execution from PHP application', 'Possible Web Server compromise activity'.","fix":"Patching the web app is not enough: on any server where a web app was compromised, find and remove the GSocket client, all its persistence (cron, systemd, shell profiles, watchdogs, extra copies) and staged files, then confirm outbound relay connections stop; rebuild the host if in doubt. Block or alert on egress to the Global Socket Relay Network and use deny-by-default outbound rules on web servers. Mount /dev/shm and /tmp noexec where possible. Patch the Linux kernel for CVE-2026-43284 (Dirty Frag) on internet-facing servers. Keep PHP apps, CMS plugins and cPanel up to date.","status":"open","published_at":null,"first_seen_at":"2026-11-11T20:44:07+00:00","triaged_at":"2026-11-11T20:44:07+00:00","updated_at":"2026-11-11T20:45:46+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-11T20:44:43Z","path":"unknown","entry":"unknown","reason":"The record says the first break-in flaws are unknown ('Which web app flaws were used for the first break-in: unknown') and does not say how the incident reached users, customers or dependents beyond the compromised web servers.","confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-2026':122B '-202611':31A '-43284':123B '2026':138B '23':167B '24':155B '31':162B '356':133B '64':153B '87':139B 'access':18A,82B 'also':115B 'apach':9A,154B 'apache':35A 'app':144B,149B,170B 'applic':61B 'attack':1A,52B,98B,114B 'august':137B 'base':16A 'block':103B 'break':2A,178B 'break-in':177B 'campaign':41B 'cmp':30A 'connect':85B 'cpanel':8A,34A,151B 'curl':71B 'cve':121B 'defend':130B 'detect':131B 'dirti':124B 'domain':101B 'download':67B 'earli':43B 'early-warn':42B 'educ':159B 'face':59B 'first':176B 'flaw':110B,120B,171B 'frag':125B 'get':127B 'global':90B 'gs':76B 'gs-netcat':75B 'gsocket':12A,33A,74B 'hack':56B 'hit':157B 'hole':26A 'host':146B,152B 'http':36A 'incid':48B,141B 'instal':11A,73B 'internet':58B 'internet-fac':57B 'ip':99B 'keep':21A 'kernel':40A,119B 'linux':4A,39A,63B,118B 'march':135B 'microsoft':29A,45B,129B 'mjx37p':32A 'multipl':47B 'netcat':77B 'network':93B 'open':79B 'origin':109B 'outbound':86B 'patch':28A,112B 'php':7A,38A,147B 'public':89B 'relay':15A,92B 'relay-bas':14A 'remot':17A,81B 'report':46B 'research':161B 'root':128B 'rose':132B 'script':69B 'sector':158B 'server':6A,37A 'sever':50B 'socket':91B 'sourc':80B 'stay':106B 'technolog':164B 'telecom':166B 'tool':19A,83B 'tri':116B 'unknown':180B 'unrel':51B 'use':65B,173B 'warn':44B 'web':5A,60B,143B,148B,169B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["apachehttpserver","cpanel","gsocket","httpserver","kernel","linuxkernel","php"],"ptokens":["apache","cpanel","gsocket","http","kernel","linux","php","server"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"exploitation","search_a":"'-202611':31A 'access':18A 'apach':9A 'apache':35A 'attack':1A 'base':16A 'break':2A 'cmp':30A 'cpanel':8A,34A 'gsocket':12A,33A 'hole':26A 'http':36A 'instal':11A 'keep':21A 'kernel':40A 'linux':4A,39A 'microsoft':29A 'mjx37p':32A 'patch':28A 'php':7A,38A 'relay':15A 'relay-bas':14A 'remot':17A 'server':6A,37A 'tool':19A 'web':5A","search_b":"'-2026':122B '-43284':123B '2026':138B '23':167B '24':155B '31':162B '356':133B '64':153B '87':139B 'access':82B 'also':115B 'apach':154B 'app':144B,149B,170B 'applic':61B 'attack':52B,98B,114B 'august':137B 'block':103B 'break':178B 'break-in':177B 'campaign':41B 'connect':85B 'cpanel':151B 'curl':71B 'cve':121B 'defend':130B 'detect':131B 'dirti':124B 'domain':101B 'download':67B 'earli':43B 'early-warn':42B 'educ':159B 'face':59B 'first':176B 'flaw':110B,120B,171B 'frag':125B 'get':127B 'global':90B 'gs':76B 'gs-netcat':75B 'gsocket':74B 'hack':56B 'hit':157B 'host':146B,152B 'incid':48B,141B 'instal':73B 'internet':58B 'internet-fac':57B 'ip':99B 'kernel':119B 'linux':63B,118B 'march':135B 'microsoft':45B,129B 'multipl':47B 'netcat':77B 'network':93B 'open':79B 'origin':109B 'outbound':86B 'patch':112B 'php':147B 'public':89B 'relay':92B 'remot':81B 'report':46B 'research':161B 'root':128B 'rose':132B 'script':69B 'sector':158B 'sever':50B 'socket':91B 'sourc':80B 'stay':106B 'technolog':164B 'telecom':166B 'tool':83B 'tri':116B 'unknown':180B 'unrel':51B 'use':65B,173B 'warn':44B 'web':60B,143B,148B,169B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-11T19:49:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-mjx37p","url":"https://www.microsoft.com/en-us/security/blog/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T20:44:07+00:00","fetched_at":"2026-11-11T20:44:07+00:00","note":null,"cites":["https://www.microsoft.com/en-us/security/blog/"]}],"documents":[{"id":128532,"url":"https://x.com/MsftSecIntel/status/2120609029001032115","title":"@MsftSecIntel: Microsoft observed multiple incidents in which threat actors deployed GSocket on","kind":"post","source":"x","publisher":null,"text":"Microsoft observed multiple incidents in which threat actors deployed GSocket on compromised Linux servers to maintain access after the original vulnerabilities were remediated, turning a single web application compromise into persistent access. https://t.co/cdEtPaRWEd\n\nlikes 20 reposts 6","published_at":"2026-11-11T20:06:06+00:00","relation":"describes","confidence":null,"note":null},{"id":128741,"url":"https://www.microsoft.com/en-us/security/blog/","title":"The global socket: how threat actors are weaponizing GSocket for stealthy C2 | Microsoft Security Blog","kind":"blog","source":"analyst","publisher":null,"text":"Microsoft observed multiple incidents in which threat actors deployed GSocket (open source remote access tool, Global Socket Relay Network) on compromised Linux servers after exploiting internet-facing web apps, keeping access after the original vulnerability was patched. Detections up 356.2% March-August 2026; 87.1% web apps/hosting, PHP web apps and cPanel 63.9%, Apache 24.3%; education/research 30.7%, tech/telecom 22.9%. Deployment via curl-downloaded script, GSocket client staged in /dev/shm, process renamed to kernel-thread-like names, persistence via cron, systemd, shell profiles, watchdogs, redundant copies; secret delivered via console, temp file, Telegram (GS_TG_TOKEN, GS_TG_CHATID), Discord or webhook. Some attempted CVE-2026-43284 (Dirty Frag) for root. No attacker-owned IP/domain to block; restrict egress to the relay. Defender alerts: 'GsNetcat' hacktool.","published_at":"2026-11-11T19:49:57+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}