XLab identifies CWPdoor backdoor spreading through compromised Control Web Panel server

XLab identified CWPdoor, a recently identified Linux backdoor that spreads through a compromised cwpsrv binary, the web server component of the Control Web Panel management interface, after finding the malware on June 29, which is when the research unit detected it. The backdoor remains inactive on an infected machine until the operator transmits a specially designed request, a passive triggering mechanism that keeps it dormant until activated.

On June 29, XLab found the malware after intercepting a script that pretended to be an updater and swapped the legitimate cwpsrv binary for a malicious one. To conceal the swap, the script restores file and directory timestamps, removes temporary files, and erases the command-history log.

More than 340,000 CWP instances appeared on the public web during the past month, XLab reported, a figure that reflects the targeting scale of the campaign across many servers. The script targets cwpsrv versions 1.15.10 and 1.24.0 for replacement, which are the affected versions.

Control Web Panel, once called CentOS Web Panel, is open-source hosting administration software comparable to cPanel and Plesk for managing e-mail, DNS, databases, and web servers.

Operators trigger the backdoor with an encrypted HTTP header labeled X-Ngx-Integrity-Data, accompanied by X-Ngx-Integrity-Time for the timestamp and X-Ngx-Integrity-Sig for the RSA signature, which together form the activation mechanism. The backdoor confirms the timestamp is within a five-minute window, validates the RSA signature, decrypts the command, and hands it to a helper process for execution, which then runs the command on the server.

XLab states that linking the timestamp, ciphertext, and signature enforces a plus-or-minus 300-second window for replay protection and authorization control, a cryptographic binding that prevents tampering. Altering the timestamp or the ciphertext on its own breaks the RSA signature check, and AES-256-CBC encryption protects both the issued commands and the results they return.

The backdoor modifies the server logging module to keep the triggering request out of access logs, a log suppression technique. XLab, the QiAnXin Technology Group research unit, describes the malware as exceptionally stealthy because it triggers passively and suppresses logs.

Researchers spotted CWPdoor on VirusTotal on September 30 inside an archive that also contained the Ebury backdoor. The malicious cwpsrv file named cwpsrv.suspeito in that archive received zero detections, which is antivirus evasion evidence.

XLab says the clean VirusTotal result shows real victims exist in the wild, but the link between Ebury and CWPdoor remains unclear.

The Ebury botnet operation, which steals credentials and acts as a Linux backdoor, has operated since at least 2009, providing related malware background. An ESET report published in May 2024 estimated that Ebury infected nearly 400,000 servers from its emergence onward, a historical infection scale that shows the botnet’s long reach.

Defenders should look for the ngx_http_integrity_helper Unix socket, unusual cwpsrv helper processes, and X-Ngx-Integrity strings inside the server binary, which are defensive indicators. After confirming compromise, administrators should install a legitimate binary, update CWP to the latest version, change all control panel credentials, and search the host for more malware, which are remediation steps.