Threat actors are abusing GSocket, a legitimate open-source tunneling tool, to establish persistent encrypted backdoors on Linux systems by delivering it through malicious bash scripts. Because GSocket creates outbound-only encrypted tunnels, traditional perimeter firewalls and NAT controls provide no effective defense, leaving affected organizations with unauthorized remote access that is difficult to detect at the network edge without endpoint telemetry. Any Linux environment where an attacker can execute a bash script is at risk, and the primary business impact is covert, long-term access to internal systems without triggering standard network-based alerting.