CWPdoor: Trojanized CWP Web Panel Binary Backdoors Linux Servers
Researchers at XLab (QiAnXin Technology Group) discovered CWPdoor, a passive Linux backdoor distributed via a trojanized version of cwpsrv, the web server powering Control Web Panel (CWP), a hosting management tool similar to cPanel and Plesk. More than 340,000 CWP instances are exposed publicly, and the malicious updater script replaces legitimate cwpsrv versions 1.15.10 and 1.24.0 while hiding its tracks by restoring timestamps and wiping logs. The backdoor was first captured on June 29 and later found uploaded to VirusTotal on September 30 alongside the Ebury backdoor, with zero antivirus detections, suggesting real-world victims already exist. The link between CWPdoor and Ebury remains unclear to researchers.
Detalhes técnicos
CWPdoor is triggered passively via a crafted HTTP request containing an encrypted X-Ngx-Integrity-Data header, plus X-Ngx-Integrity-Time and X-Ngx-Integrity-Sig headers for timestamp and RSA signature verification. Commands and output are encrypted with AES-256-CBC, and the backdoor enforces a ±300-second replay-protection window tied to the RSA signature before decrypting and executing commands via a helper process. It also tampers with the server's logging module to suppress evidence of the triggering request from access logs.
Remediação
Administrators should check for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings in the server binary. If compromised, replace the backdoored binary with a legitimate copy, upgrade CWP to the latest version, rotate all control panel credentials, and investigate the host for additional malware such as Ebury.
Linha do tempo
-
CWPdoor: Trojanized CWP Web Panel Binary Backdoors Linux Servers
ler a análise desta fonte ocultar
Researchers at XLab (QiAnXin Technology Group) discovered CWPdoor, a passive Linux backdoor distributed via a trojanized version of cwpsrv, the web server powering Control Web Panel (CWP), a hosting management tool similar to cPanel and Plesk. More than 340,000 CWP instances are exposed publicly, and the malicious updater script replaces legitimate cwpsrv versions 1.15.10 and 1.24.0 while hiding its tracks by restoring timestamps and wiping logs. The backdoor was first captured on June 29 and later found uploaded to VirusTotal on September 30 alongside the Ebury backdoor, with zero antivirus detections, suggesting real-world victims already exist. The link between CWPdoor and Ebury remains unclear to researchers.
Technical Details
CWPdoor is triggered passively via a crafted HTTP request containing an encrypted X-Ngx-Integrity-Data header, plus X-Ngx-Integrity-Time and X-Ngx-Integrity-Sig headers for timestamp and RSA signature verification. Commands and output are encrypted with AES-256-CBC, and the backdoor enforces a ±300-second replay-protection window tied to the RSA signature before decrypting and executing commands via a helper process. It also tampers with the server's logging module to suppress evidence of the triggering request from access logs.
Remediation
Administrators should check for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings in the server binary. If compromised, replace the backdoored binary with a legitimate copy, upgrade CWP to the latest version, rotate all control panel credentials, and investigate the host for additional malware such as Ebury.