ctrlINT What the industry said about every indicator, with the quote

gsocket[.]ioDomain

Reported by 2 independent sources · first reported by Group-IB · last reported

Last reported 9 days ago

What the reports say

2 reports, newest first · the exact sentence from each

  1. “…oyed the framework’s binary, gs-netcat, which forces the internal host to establish an outbound connection to the public relay server (gsocket[.]io).”

    Palo Alto Unit 42Vendor
    AI-Powered Espionage Campaign Targets Government Linux Infrastructure

  2. “It then detects the host’s OS and CPU architecture, downloads the appropriate precompiled gs-netcat binary from gsocket[.]io/bin, and installs persistent reverse shell access connecting through the operator’s relay at gsnc.eu:67.”

    Group-IBVendor
    ClickLock Stealer: Paste Once, Lose Everything

Indicators reported together

named in the same reports

Also named with it: CVE-2025-55182, CVE-2021-4034

Thanks — we review every report.

Report a wrong value
What is wrong with gsocket[.]io here?
No account needed. We do not store your IP address.