CWPdoor: passive Linux backdoor hidden in trojanized Control Web Panel cwpsrv binary, found by XLab

Linha do tempo

1. securityonline.info ↗ · pub. 10/11/2026 03:20 · coletado 10/11 04:00

   CWPdoor backdoor hidden in Control Web Panel cwpsrv binary enables passive root command execution

   ler a análise desta fonte ocultar

   QiAnXin XLab documented CWPdoor, a passive Linux backdoor compiled into cwpsrv, the Nginx-based web server of Control Web Panel (formerly CentOS Web Panel), a hosting panel with more than 340,000 internet-facing instances in the article's count. The implant reaches a host only after an attacker already holds root, through a fake updater script named cwpsrv_update.sh that swaps the genuine binary for a trojanized one. Once in place it waits for signed, encrypted commands carried in HTTP headers and removes its own traces from the access log. A backdoored build reached VirusTotal from Brazil on September 30, 2026, inside an archive that also held the Ebury SSH backdoor, but no attacker group is named and the initial access method is unknown. The backdoor has no CVE and no vendor patch addresses it (threatdefence.com), so the risk is concentrated on panels that are already compromised; the exposure figure counts possible targets, not infections.

   Technical Details

   • The installer checks whether the local cwpsrv is version 1.15.10 or 1.24.0, downloads the matching trojanized ELF, backs up the genuine binary, stops the panel, overwrites the executable, and restarts the service.
   • It verifies that the master, worker and helper processes run after restart and rolls back if the check fails; on success it deletes the temporary files and the backup.
   • It restores the original access and modification times on the binary and its parent folder and clears the shell history, so routine checks with ls and stat appear to show the file was never modified.
   • The backdoor adds no listening TCP port. At startup it binds an abstract Unix domain socket named ngx_http_integrity_helper and spawns a child process titled "helper process".
   • Commands arrive in three custom headers: X-Ngx-Integrity-Time, X-Ngx-Integrity-Data and X-Ngx-Integrity-Sig. The timestamp must fall within a 300-second window, and the Base64 signature is checked against an embedded RSA-2048 public key that is stored XOR-masked with 0x55. Requests that fail either check are served as ordinary web traffic.
   • On success the master process derives an AES-256-CBC key from the SHA-256 hash of the RSA public key string, passes the decrypted command to the helper over the local socket, and runs it with popen. The AES-encrypted output returns in an HTTP 200 response.
   • The module context array is altered so the logging module is skipped, which leaves no entries in the web access logs for these requests.

   Remediation

   • Isolate the server and replace the modified cwpsrv with a verified clean build; threatdefence.com recommends updating CWP to 1.30.3 or later and rebuilding or reinstalling the panel.
   • Check for the socket with ss -axp | grep integrity, look for an unexpected "helper process" child under cwpsrv, and scan the binary for X-Ngx-Integrity strings (threatdefence.com, citing XLab).
   • Audit the whole Linux host for secondary implants such as Ebury, because the installer deletes its own backup and requires root, so the entry point may not be visible.
   • Rotate all panel, database and SSH credentials from a clean workstation, and assume that any command the backdoor could run has been compromised.
   • No Fix Details section applies: the article describes malware planted after root access, not a flaw in the panel code.
2. thehackernews.com ↗ · pub. 06/11/2026 02:58 · coletado 06/11 06:00

   cwpdoor backdoor found in trojanized Control Web Panel cwpsrv web server, runs unlogged commands on root-compromised Linux hosts

   This article adds the full IOC set (installer, backdoored binary hashes, download IP and URLs), the prerequisite of root access with the initial access method unknown, the 0/63 VirusTotal detection, specific detection commands and the cwpsrv.prev backup that the installer may delete. It states that the Brazil upload also held Ebury and that XLab does not know whether the two are related. It does not repeat the 340,000 exposed instances figure, which appears only in the earlier published report, not in this article.

   ler a análise desta fonte ocultar

   This article adds the full IOC set (installer, backdoored binary hashes, download IP and URLs), the prerequisite of root access with the initial access method unknown, the 0/63 VirusTotal detection, specific detection commands and the cwpsrv.prev backup that the installer may delete. It states that the Brazil upload also held Ebury and that XLab does not know whether the two are related. It does not repeat the 340,000 exposed instances figure, which appears only in the earlier published report, not in this article.

   Researchers at QiAnXin's XLab found cwpdoor, a backdoor hidden in a rebuilt cwpsrv, the web server of Control Web Panel (CWP). XLab captured the installer, a shell script posing as a version update, on June 29. On September 30 an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil. XLab takes this as a sign that real victims exist, but gives no count of infected servers. Installing the backdoor needs root access, so the attacker must already control the server. How attackers get that root access is unknown. No CVE and no vendor advisory were cited in the article, and no further research was done.

   Technical Details

   • The installer handles only cwpsrv 1.15.10 and 1.24.0. It restores the original file dates, so ls and stat show the file as unchanged.
   • The backdoor behaves like normal cwpsrv until a request arrives with a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. It then runs the command in the request, and the request never appears in access logs.
   • The backdoor uses the Unix socket ngx_http_integrity_helper.
   • The backdoored file had 0/63 detections on VirusTotal.
   • The archive from Brazil also held Ebury. XLab does not know whether the two are related and says different attackers may have planted them.
   • IOCs published by XLab:
     • MD5 e505d4ffa21cf494a5dc2d7c8f4f1236 (cwpsrv_update.sh)
     • MD5 965aea67fb40de1bab5169ada993349f (backdoored cwpsrv 1.15.10)
     • MD5 d3f4e95113d49ab3991b45e457bda75b (backdoored cwpsrv 1.24.0)
     • IP 136.0.141[.]71
     • URLs https://136.0.141[.]71/static/cwpsrv_update.sh, /static/cwpsrv_1.15.10 and /static/cwpsrv_1.24.0

   Remediation

   • Detection:
     • Run ss -axp | grep integrity and look for ngx_http_integrity_helper.
     • Run ps aux | grep cwpsrv and look for unexpected helper processes.
     • Run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity.
   • Restore the original cwpsrv from the backup named cwpsrv.prev-<date/time> in /usr/local/cwpsrv/bin. The installer may have deleted this backup.
   • Upgrade to the latest version and confirm the socket check returns nothing.
   • Change all control panel credentials, treat the whole server as compromised and check it for other threats.
3. bleepingcomputer.com ↗ · pub. 05/11/2026 13:24 · coletado 05/11 14:00 primeiro registro

   CWPdoor passive Linux backdoor distributed via trojanized Control Web Panel cwpsrv web server binary

   ler a análise desta fonte ocultar

   A new Linux backdoor, CWPdoor, is delivered through a trojanized version of cwpsrv, the web server behind Control Web Panel (CWP), formerly CentOS Web Panel. XLab (QiAnXin) found it on June 29 after capturing a fake updater script that swaps the legitimate binary. A sample with zero antivirus detections was uploaded to VirusTotal on September 30 in an archive that also held the Ebury backdoor. XLab says this points to real victims, but the link between Ebury and CWPdoor is unclear. XLab reports more than 340,000 CWP instances exposed on the public web over the past month. That figure is exposure, not confirmed compromise. This summary is based on the article alone. No vendor advisory or CVE was checked or found.

   Technical Details

   • The updater script replaces cwpsrv versions 1.15.10 and 1.24.0. It restores file and directory timestamps, deletes temporary files and wipes the command history.
   • The backdoor is passive. It stays dormant until it receives an HTTP request with the headers X-Ngx-Integrity-Data (encrypted command), X-Ngx-Integrity-Time (timestamp) and X-Ngx-Integrity-Sig (RSA signature).
   • It accepts a request only if the timestamp is within ±300 seconds and the RSA signature is valid. This gives replay protection and authorization control. Commands and output are encrypted with AES-256-CBC. Valid commands are passed to a helper process for execution.
   • It interferes with the server's logging module so the triggering request does not appear in access logs.

   Remediation

   • Look for the Unix socket ngx_http_integrity_helper, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings in the cwpsrv binary.
   • If compromise is confirmed, replace the binary with a legitimate copy and upgrade to the latest version.
   • Rotate all control panel credentials and investigate the host for additional malware.