Summary

Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access. Since March, detections of malicious GSocket activity have increased, particularly in attacks targeting web applications and hosting environments.

AI summaries can be wrong sometimes—always verify important details using the source article.