CWPdoor Hides in Control Web Panel and Wipes Its Own Tracks From the Logs
XLab found a trojanized cwpsrv, the web server behind Control Web Panel, that runs RSA-signed, AES-encrypted commands sent in HTTP headers and keeps those requests out of the access log.
Someone has been swapping the web server inside Control Web Panel for a backdoored copy that stays silent until it gets a signed, encrypted command, and then keeps that request out of the logs. QiAnXin’s XLab team calls the malware CWPdoor and says real victims exist, BleepingComputer reports. CWP (formerly CentOS Web Panel) is a free cPanel-style hosting panel; XLab counted more than 340,000 instances exposed online over the past month.
For defenders
Install: XLab caught a script on June 29 posing as an updater. It replaces the legitimate cwpsrv binary (versions 1.15.10 and 1.24.0) with a trojanized build (T1554 (Compromise Host Software Binary)), restores file and directory timestamps, deletes its temp files and wipes shell history (T1070.003 (Indicator Removal: Clear Command History)). How the attackers got onto servers to run it isn’t stated.
Trigger: passive. The operator sends an HTTP request carrying three headers: X-Ngx-Integrity-Data (AES-256-CBC encrypted command), X-Ngx-Integrity-Time (timestamp, must be within ±300 seconds) and X-Ngx-Integrity-Sig (RSA signature over both). Only a valid signature gets the command decrypted and handed to a helper process; output goes back encrypted. The backdoor also tampers with the server’s logging module so the triggering request never reaches the access log.
In the wild: CWPdoor turned up on VirusTotal on September 30 in an archive alongside the long-running Ebury Linux backdoor, with the malicious cwpsrv (named cwpsrv.suspeito) at zero detections. XLab says the Ebury link is unclear. Full analysis: XLab’s write-up.
Hunt for: an ngx_http_integrity_helper Unix socket, unexpected cwpsrv helper processes, and X-Ngx-Integrity strings inside the cwpsrv binary. Since the access log is suppressed, a reverse proxy or network capture in front of the panel is your best chance of seeing the headers.
What it means for you
If you rent a server and manage it with Control Web Panel, this matters: the panel’s own web server could be quietly taking orders from someone else, and its logs won’t show it. If you’ve never heard of CWP, there’s nothing for you to do.
Do this now
- On any CWP server, check for the
ngx_http_integrity_helpersocket and search thecwpsrvbinary for “X-Ngx-Integrity”. - If you find either: replace
cwpsrvwith a clean copy, upgrade CWP to the latest version, rotate every panel credential, and check the box for other malware, Ebury included. - Don’t leave the CWP admin port open to the whole internet; limit it to your own IP or a VPN.