Since March, detections of malicious GSocket activity have increased, particularly in attacks targeting web applications and hosting environments. GSocket allows attackers to reach systems behind firewalls or NAT by intercepting network connections and replacing the program's conventional IP-layer communication with its own transport layer, which routes traffic through the Global Socket Relay Network.
Since both endpoints initiate outbound connections to the relay, which matches them and brokers an end-to-end encrypted session, an attacker can reconnect without needing the compromised server's IP address or hostname. This makes it more difficult for defenders to disrupt attacks using IP- or domain-based access control lists.
According to Microsoft Defender for Endpoint telemetry, GSocket-related detections increased by 356.2% between March and August. Microsoft explains that both the compromised server and the attacker connect outbound, hence the server needs no inbound listener implants, making the attack stealthier. "The compromised host and the operator both connect outbound to the relay, which bridges the two sessions," Microsoft explains.
