CWPdoor Linux Malware Targets Control Web Panel Servers

Security researchers at XLab have discovered a new Linux malware, CWPdoor, which is being distributed via a malicious version of the 'cwpsrv' web server. This server powers the Control Web Panel (CWP) interface, a popular administration tool for managing web hosting, email, and databases.

• CWPdoor functions as a passive backdoor that remains dormant until triggered by a specifically crafted request.
• The malware replaces the legitimate 'cwpsrv' binary and wipes evidence by restoring timestamps and deleting logs.
• Commands are encrypted with AES-256-CBC and verified through RSA signatures to ensure secure execution for the attacker.
• Evidence links the malware to the Ebury botnet, suggesting a coordinated, large-scale campaign.

Stealth and Technical Implementation

CWPdoor distinguishes itself through its exceptional stealth. It does not initiate connections; instead, it waits for an HTTP request containing specific headers like 'X-Ngx-Integrity-Data'. By binding the request to an RSA signature and a 300-second time window, the attackers effectively prevent unauthorized users from hijacking their backdoor.

Furthermore, the malware interferes with logging modules to prevent its triggering events from appearing in standard server access logs. This makes identifying an infection difficult for standard system administrators who rely solely on log analysis for security monitoring.

Connection to Ebury and Recommendations

The discovery of CWPdoor on VirusTotal alongside the long-standing Ebury backdoor—a threat active since 2009 that has compromised hundreds of thousands of servers—suggests that this is not an experimental campaign. Real-world victims have already been identified.

Administrators are advised to inspect their infrastructure for the 'ngx_http_integrity_helper' socket and any anomalous helper processes. If a compromise is confirmed, the binary must be replaced with a clean version, and all panel credentials should be rotated immediately.

Implications for the Tech Industry

For hosting providers and organizations relying on CWP to manage their server fleets, this represents a significant supply chain vulnerability. This incident highlights the critical need for verifying binary integrity and maintaining rigorous patch management cycles, as attackers continue to leverage trusted administration interfaces to gain deeper access into hosting infrastructure.