CWPdoor Backdoors Linux Servers Through Trojanized CWP Web Server

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server used by the Control Web Panel (CWP) management interface. It acts as a passive backdoor, remaining dormant until an attacker sends a specially crafted request.

Researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, said the malware’s passive trigger and log suppression make it exceptionally stealthy. XLab reported that more than 340,000 CWP instances were exposed on the public web over the past month.

The researchers found CWPdoor on June 29 after capturing an updater script that replaced the legitimate cwpsrv binary. The script targets versions 1.15.10 and 1.24.0 and attempts to hide the replacement by restoring timestamps, deleting temporary files, and wiping command history.

To activate the backdoor, an attacker sends commands in encrypted HTTP headers named X-Ngx-Integrity-Data, X-Ngx-Integrity-Time, and X-Ngx-Integrity-Sig. CWPdoor checks that the timestamp is within a five-minute window and verifies the RSA signature before decrypting the command. Commands and their output use AES-256-CBC encryption. The malware also interferes with server logging so the triggering request does not appear in access logs.

On September 30, researchers found CWPdoor in an archive uploaded to VirusTotal alongside the Ebury backdoor. The archive’s malicious cwpsrv.suspeito file had zero detections. XLab said this indicated real victims existed, though the connection between Ebury and CWPdoor remained unclear. ESET reported in May 2024 that Ebury had infected nearly 400,000 servers since emerging.