Hackers plant GSocket on Linux servers for persistent access

Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after vulnerabilities used for initial access have been patched. Microsoft Defender for Endpoint telemetry shows that GSocket-related detections increased by 356.2% from March to August.