Hackers backdoor Linux servers using trojanized CWP web server

The cybersecurity research arm of QiAnXin Technology Group, XLab, documented a Linux backdoor named CWPdoor that spreads via a malicious copy of cwpsrv, the web server used by Control Web Panel (CWP). The backdoor sits dormant until an attacker sends a specially crafted request. XLab described CWPdoor as "exceptionally stealthy" because of its passive triggering and log suppression.

Control Web Panel, previously known as CentOS Web Panel, is open-source software for managing web hosting, comparable to cPanel and Plesk. According to XLab, over 340,000 CWP instances were reachable on the public internet during the last month.

XLab found CWPdoor on June 29 when they captured a script disguised as an updater that swapped the real cwpsrv binary for a malicious one. XLab said the script targets cwpsrv versions 1.15.10 and 1.24.0. It restores file and directory timestamps, deletes temporary files, and wipes the command-history log to hide the switch. The report does not name a fixed version but recommends upgrading to the latest version.

Attackers send commands to the backdoor through an encrypted HTTP header called X-Ngx-Integrity-Data, accompanied by a timestamp in X-Ngx-Integrity-Time and an RSA signature in X-Ngx-Integrity-Sig. Commands and output are encrypted with AES-256-CBC. Before decrypting and executing the command, the backdoor confirms the timestamp is within five minutes and validates the RSA signature. XLab explained that combining the three fields and limiting the time window to ±300 seconds prevents replay and controls authorization.

The backdoor meddles with the logging module to keep the activating request out of access logs.

Following the discovery of the infection script, XLab noticed that CWPdoor was uploaded to VirusTotal on September 30 inside an archive with the Ebury backdoor. The malicious cwpsrv file in the archive had zero detections. XLab said that indicates the campaign was not experimental and that real victims already exist. The connection between Ebury and CWPdoor remains unclear, according to XLab. Ebury is a botnet that steals credentials and provides backdoor access to Linux systems, operating since at least 2009. A May 2024 ESET report said Ebury had infected nearly 400,000 servers since it emerged.

XLab advises administrators to look for the Unix socket ngx_http_integrity_helper, unusual cwpsrv helper processes, and X-Ngx-Integrity strings in the server binary. If an infection is found, swap the malicious binary for a clean one, update to the newest release, change all control panel passwords, and scan the server for other malware.