CWPdoor Hides in Control Web Panel and Wipes Its Own Tracks From the Logs
XLab found a trojanized cwpsrv, the web server behind Control Web Panel, that runs RSA-signed, AES-encrypted commands sent in HTTP headers and keeps those requests out of the access log.