EN PT-BR
← Voltar ao feed
high hosting

CWPdoor: trojanized Control Web Panel cwpsrv binary plants a passive, log-evading Linux backdoor

2 fonte(s) · 2 atualização(ões) · publicado 05/11/2026 13:24 · coletado há 1 hora

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 06/11/2026 06:02; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ bleepingcomputer.com ↗

Researchers at XLab (QiAnXin) found CWPdoor, a passive Linux backdoor hidden in a trojanized build of cwpsrv, the web server behind Control Web Panel (CWP), a hosting management panel similar to cPanel and Plesk (bleepingcomputer.com, thehackernews.com). The backdoored server runs commands sent in web requests, and those requests never appear in its access logs (thehackernews.com). More than 340,000 CWP instances are exposed publicly (bleepingcomputer.com). A malicious updater script replaces legitimate cwpsrv versions 1.15.10 and 1.24.0 and covers its tracks by restoring timestamps and wiping logs (bleepingcomputer.com). The sample was first captured on June 29 and later turned up on VirusTotal on September 30 next to the Ebury backdoor, with zero antivirus detections, which suggests real victims already exist (bleepingcomputer.com). Installing the implant requires root access, so the attackers must already control the server (thehackernews.com). The relationship between CWPdoor and Ebury is still unclear (bleepingcomputer.com).

Detalhes técnicos

  • Trigger: CWPdoor is passive. It activates on a crafted HTTP request carrying an encrypted X-Ngx-Integrity-Data header, plus X-Ngx-Integrity-Time and X-Ngx-Integrity-Sig headers for the timestamp and RSA signature check (bleepingcomputer.com).
  • Crypto and replay protection: Commands and output are encrypted with AES-256-CBC. A ±300-second replay-protection window is tied to the RSA signature and is checked before the command is decrypted and run through a helper process (bleepingcomputer.com).
  • Anti-forensics: The backdoor tampers with the server's logging module so the triggering request is left out of access logs (bleepingcomputer.com, thehackernews.com). The updater script also restores timestamps and wipes logs (bleepingcomputer.com).
  • Detection status: The sample had zero AV detections on VirusTotal (bleepingcomputer.com).

Remediação

  • Look for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings in the server binary (bleepingcomputer.com).
  • If a host is compromised, replace the backdoored binary with a legitimate copy and upgrade CWP to the latest version (bleepingcomputer.com).
  • Rotate all control panel credentials (bleepingcomputer.com).
  • Investigate the host for additional malware such as Ebury (bleepingcomputer.com). Because installation needs root, treat the whole server as compromised (thehackernews.com).

Linha do tempo

  1. thehackernews.com ↗ · pub. 06/11/2026 02:58 · coletado 06/11 06:00

    Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

    ler a análise desta fonte

    A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week.

    The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.

  2. bleepingcomputer.com ↗ · pub. 05/11/2026 13:24 · coletado 05/11 14:00 primeiro registro

    CWPdoor: Trojanized CWP Web Panel Binary Backdoors Linux Servers

    ler a análise desta fonte

    Researchers at XLab (QiAnXin Technology Group) discovered CWPdoor, a passive Linux backdoor distributed via a trojanized version of cwpsrv, the web server powering Control Web Panel (CWP), a hosting management tool similar to cPanel and Plesk. More than 340,000 CWP instances are exposed publicly, and the malicious updater script replaces legitimate cwpsrv versions 1.15.10 and 1.24.0 while hiding its tracks by restoring timestamps and wiping logs. The backdoor was first captured on June 29 and later found uploaded to VirusTotal on September 30 alongside the Ebury backdoor, with zero antivirus detections, suggesting real-world victims already exist. The link between CWPdoor and Ebury remains unclear to researchers.

    Technical Details

    CWPdoor is triggered passively via a crafted HTTP request containing an encrypted X-Ngx-Integrity-Data header, plus X-Ngx-Integrity-Time and X-Ngx-Integrity-Sig headers for timestamp and RSA signature verification. Commands and output are encrypted with AES-256-CBC, and the backdoor enforces a ±300-second replay-protection window tied to the RSA signature before decrypting and executing commands via a helper process. It also tampers with the server's logging module to suppress evidence of the triggering request from access logs.

    Remediation

    Administrators should check for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings in the server binary. If compromised, replace the backdoored binary with a legitimate copy, upgrade CWP to the latest version, rotate all control panel credentials, and investigate the host for additional malware such as Ebury.