Skip to main content
Apexward Pulse
3 reportsPriority High

Hackers plant GSocket on Linux servers for persistent access

Threat actors are using a legitimate remote access tool to maintain control of Linux servers after initial breaches, posing an ongoing risk to UK organisations.

First report Latest

What is going on

  • Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers.
  • This persistence mechanism allows attackers to retain control even after vulnerabilities used for initial access have been patched.
  • Researchers have identified this activity as part of ongoing cyber operations targeting Linux environments.

Reports in this story

Newest first. Each one is a separate event with its own sources and evidence.

Back to the feed