GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)
2026-03-20T19:23:46Z•536fa01e10b81a7111d0ce60486b4125fcb4d89c8481a8a7d40551065da5ee5e
GSocketadminerbackdoorbashcowriehoneypotipv4-mapped-ipv6linuxmalwarephpmyadminportscanproxy-scanscanningtelnetthreat-intelunknown-delivery-vector
What happened
SANS ISC diary entries report a newly observed Linux-focused campaign: a malicious Bash script was found that installs a "GSocket" backdoor on victim machines (delivery vector unknown). Related entries describe widespread scanning activity seen in honeypots (cowrie) including Telnet brute-force/logins, probes for phpMyAdmin/Adminer, /proxy/ URL proxy-abuse patterns, and use of IPv4-mapped IPv6 addresses possibly to obfuscate origin. One cowrie capture included a distinct payload marker string and activity from an IP with portscans and web access. No specific CVEs were mentioned in the posts.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 536fa01e10b81a7111d0ce60486b4125fcb4d89c8481a8a7d40551065da5ee5e
- Enrichment time
- 2026-03-20T19:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.