Researchers at XLab, the research arm of QiAnXin, have documented a new Linux backdoor they call CWPdoor. It is spread as a trojanized copy of cwpsrv, the web server that runs the management interface of Control Web Panel (CWP, formerly CentOS Web Panel), an open-source hosting control panel comparable to cPanel and Plesk. XLab captured an infection script on June 29 that poses as a version update: it checks the local cwpsrv version, downloads a matching malicious binary, backs up the original, stops the service, overwrites /usr/local/cwpsrv/bin/cwpsrv, restarts it, and rolls back automatically if the health check fails. It then restores file timestamps, deletes temporary files and wipes command history. The script supports only cwpsrv versions 1.15.10 and 1.24.0.
CWPdoor is passive: it does nothing until the attacker sends a specially crafted HTTP request carrying three headers (X-Ngx-Integrity-Data, X-Ngx-Integrity-Time and X-Ngx-Integrity-Sig). The command is AES-256-CBC encrypted, signed with RSA, and must arrive within a five-minute window. The backdoor also tampers with the server’s logging so the triggering request never appears in access logs, and returns its output as an encrypted HTTP 200 response. On September 30, a file from Brazil was uploaded to VirusTotal containing the CWPdoor binary alongside the Ebury backdoor; the CWPdoor file had zero detections, which XLab takes as a sign that real victims exist. XLab says it does not yet know how the malware spreads or how it relates to Ebury, which may have been planted on the same server by a different attacker. XLab cites data from QiAnXin’s Hunter platform showing more than 340,000 CWP instances exposed to the internet over the past month, all of which are potential targets.
How to check if you’re affected
Affected products are servers running Control Web Panel, and in particular hosts where cwpsrv has been replaced. The captured script targets cwpsrv versions 1.15.10 and 1.24.0. XLab has not identified the infection route, so there is no known list of unaffected builds. XLab’s indicators of infection:
- A Unix domain socket named
ngx_http_integrity_helper. XLab’s guidance is to confirm thatss -axp | grep integrityreturns nothing after cleanup. - Suspicious helper processes spawned by
cwpsrv. - The strings
X-Ngx-Integrityinside thecwpsrvbinary. - A backup of the original binary in
/usr/local/cwpsrv/bin, namedcwpsrv.prev-<date>-<time>, left by the infection script. - Network and file indicators from the XLab report: downloader IP 136.0.141[.]71 (serving
cwpsrv_update.sh,cwpsrv_1.15.10andcwpsrv_1.24.0), script MD5e505d4ffa21cf494a5dc2d7c8f4f1236, and MD5s965aea67fb40de1bab5169ada993349f(1.15.10 binary) andd3f4e95113d49ab3991b45e457bda75b(1.24.0 binary).
If you confirm a compromise, XLab recommends replacing the malicious binary with the legitimate backup, upgrading to the latest version, and rotating all control panel credentials, since the backdoor can run arbitrary commands. It also advises treating the host as compromised and investigating it for other malware. Because the backdoor suppresses its own log entries, a clean access log is not evidence that a host is clean.