Control Web Panel Servers Targeted by Stealthy CWPdoor Backdoor

Cybersecurity researchers uncovered a stealthy Linux backdoor hiding inside modified versions of Control Web Panel server software. The malicious implant executes unauthorized commands without creating log entries and remains passive until activated by encrypted web requests.

Trojanized Web Server Operates Without Log Traces

The newly discovered malware, named CWPdoor, directly targets cwpsrv, the core web server component responsible for running Control Web Panel (CWP). Analysts at XLab, the cybersecurity research division of QiAnXin Technology Group, first captured a malicious installation script on June 29. The script disguised itself as a legitimate version update and replaced authentic web server files on compromised machines. According to the research team, the installer specifically alters cwpsrv versions 1.15.10 and 1.24.0 to establish long-term access.

What sets CWPdoor apart from standard server implants is its unusually high degree of operational stealth. When processing malicious commands sent by remote operators, the trojanized web server suppresses its internal logging routines to prevent requests from appearing in access logs. Furthermore, the installation script actively cleans up after itself by erasing temporary files, wiping command-history logs, and resetting modified directory timestamps to match original values. As reported by BleepingComputer, these evasive techniques make standard forensic inspection using command-line file checks virtually ineffective.

Cryptographic Verification and Replay Protection

The backdoor remains entirely dormant until receiving a specifically crafted HTTP request carrying custom header fields. Remote operators trigger execution by transmitting encrypted commands through the X-Ngx-Integrity-Data header, accompanied by timestamp and RSA signature headers. The malware verifies that the incoming request timestamp falls within a strictly enforced five-minute window before verifying the cryptographic signature. Once validated, commands and their outputs are decrypted using AES-256-CBC encryption and passed to an internal helper process for execution.

Evidence gathered by security analysts indicates that active infections are already occurring across public infrastructure. On September 30, a compressed archive containing a sample of the backdoor binary was submitted to the VirusTotal scanning platform from an IP address in Brazil. When researchers evaluated the submitted sample, titled cwpsrv.suspeito, it registered zero detections across 63 different antivirus engines. The Hacker News reported that this lack of detection strongly suggests real-world victims were already compromised prior to public discovery.

Coexistence With Ebury and Widespread Exposure

The archive uploaded from Brazil also contained components associated with Ebury, a notorious OpenSSH backdoor and credential stealer active since at least 2009. Cybersecurity company ESET previously disclosed in May 2024 that Ebury had compromised nearly 400,000 Linux servers over its multi-year operational lifespan. Researchers from XLab noted that while both malware families were present on the same archive, it remains uncertain whether they originate from the same threat actor group or if independent attackers compromised the server.

Control Web Panel, formerly known as CentOS Web Panel, serves as an open-source server administration platform comparable to cPanel and Plesk, allowing administrators to manage web services, databases, DNS settings, and email accounts. Telemetry analyzed by XLab revealed that more than 340,000 CWP instances were exposed directly to the public web over the past month. Because installing CWPdoor requires existing root privilege on the underlying Linux host, security teams suspect attackers are exploiting unpatched vulnerabilities or compromised administrative credentials to gain initial access.

Detection Methods and Immediate Mitigation

Security researchers advise system administrators to perform technical audits to determine whether their Linux hosting servers have been compromised by CWPdoor. Defenders should check for the presence of an active Unix socket named ngx_http_integrity_helper and inspect server binaries for hidden custom HTTP header strings. Additionally, administrators can monitor active system processes for anomalous helper processes spawned by the web server service. Standard port scans may not reveal the intrusion, as the backdoored web server operates on existing legitimate web ports without opening additional listening sockets.

If an infection is confirmed, security specialists urge administrators to take immediate cleanup and hardening actions. Systems teams must replace the backdoored web server binary with an official, unmodified copy and update Control Web Panel to the latest release. Organizations should also rotate all administrative credentials associated with the control panel and perform a comprehensive forensic scan of the underlying host to identify additional persistent threats.

Background

Control Web Panel has long been a popular open-source control interface for Linux hosting providers seeking an alternative to proprietary management tools. Its wide adoption across public cloud providers and dedicated hosting environments makes it a frequent target for threat actors seeking server infrastructure for malicious operations. In recent years, attackers have increasingly focused on web management panels because compromising a single administrative server grants control over hosted websites, databases, and customer credentials.

The emergence of stealthy passive backdoors represents an ongoing shift in Linux malware development toward long-term persistence and evasion. Rather than maintaining active outgoing command-and-control connections that security tools can easily detect, passive implants listen silently on existing web services until triggered by valid cryptographic keys. This approach allows threat actors to maintain access for extended periods while minimizing network traffic anomalies.

Why It Matters

The discovery of CWPdoor underscores the rising security risks facing web hosting infrastructure running open-source administration tools. Because the backdoor suppresses access logs and bypasses traditional antivirus detection, organizations managing Linux servers may need to re-evaluate their monitoring strategies to detect passive, cryptographically validated implants before critical data is compromised.

Illustration: AI-generated image, not a photograph of the event.