WORLDTECHMicrosoft Says Attackers Hid Linux Backdoors Behind GSocket Processes
Microsoft has described attackers who deployed the open source remote access tool GSocket on compromised Linux servers, with processes disguised as legitimate system components. According to GBHackers, which reports on Microsoft's November 11 report, the intruders kept access even after the original vulnerabilities were patched.
How the intruders kept their foothold
GBHackers reports that GSocket was placed on servers attackers had already compromised, with its processes made to look like legitimate system components.
Access persisted after administrators patched the original vulnerabilities, so closing the initial weakness did not by itself remove the intruders from the systems.
Microsoft's view of the threat actors
In its November 11 report, Microsoft described several unrelated threat actors abusing the tool. Instead of operating dedicated command-and-control infrastructure, they relied on GSocket itself.
The GBHackers account cites Defender for Endpoint telemetry showing a 356.2% increase in related activity.
What is reported and what is not verified
The findings come from a single outlet's account of Microsoft's November 11 report. The figures and descriptions are as that account gives them and have not been checked against the original document for this report.
Open questions
- Which servers and organisations were affected?
- What period does the 356.2% increase cover?