CWP web server backdoor hides command execution from logs

Researchers at QiAnXin XLab have identified a Linux backdoor named cwpdoor embedded in the web server used by Control Web Panel (CWP), a free management panel for Linux hosting servers. The altered server executes commands supplied through specially constructed web requests while ensuring those requests do not appear in access logs.

The installer observed by XLab was a shell script masquerading as a version update. It supports two cwpsrv releases, 1.15.10 and 1.24.0, and requires root privileges to replace the web-server executable. The researchers have not established how attackers obtain that initial root access.

A rebuilt server binary rather than a separate process

XLab’s analysis found that cwpdoor is the cwpsrv binary rebuilt with additional code. It retains normal behaviour until it receives a request containing a valid timestamp and signature in custom headers beginning with X-Ngx-Integrity. It then runs the command carried by the request.

When swapping the executable, the installer resets the replacement file’s timestamps to match the original. As a result, basic checks using ls or stat can show no visible change. In the researchers’ analysis, the malicious file had zero detections among 63 VirusTotal engines.

The threat also illustrates a pattern seen in Linux rootkit and AI attack developments where Linux-focused intrusions can combine stealth mechanisms with privileged access, making superficial host checks insufficient.

Indicators and validation steps

One useful indicator is the Unix socket used by the backdoor. Administrators can run ss -axp | grep integrity; a result referring to ngx_http_integrity_helper is a sign of infection. XLab noted that this check detected the backdoor on a server whose open-port list appeared normal.

Its other suggested checks are to inspect cwpsrv-related processes with ps aux | grep cwpsrv for unexpected helper processes, and to search /usr/local/cwpsrv/bin/cwpsrv with strings for the X-Ngx-Integrity header names. XLab published MD5 values for the installer and the two altered binaries, as well as the download infrastructure at 136.0.141[.]71.

Containment must assume full server compromise

For an infected host, XLab recommends restoring the original cwpsrv from a backup in /usr/local/cwpsrv/bin whose name begins with cwpsrv.prev-. That backup may no longer exist because the installer description says temporary files and the backup are deleted after a successful replacement.

Administrators should upgrade CWP, verify that the integrity socket is absent, change all control-panel credentials, and investigate the entire system for additional threats. An archive submitted to VirusTotal from Brazil also contained Ebury, an OpenSSH backdoor and credential stealer; XLab does not establish a connection between the two pieces of malware. The practical implication is that a confirmed cwpdoor finding requires credential rotation and a full compromise assessment, not merely replacement of one binary.