Threat actors abuse GSocket for persistent Linux access

Multiple threat actors are exploiting GSocket, a legitimate open-source remote access tool, to maintain persistence on Linux servers after gaining initial access through vulnerabilities. The tool's legitimate functionality allows attackers to evade detection even after patching the initial entry points. Organizations should monitor for unauthorized GSocket usage and restrict tool execution.