CWPdoor is a stealthy Linux malware strain currently targeting the Control Web Panel management interface by replacing the legitimate cwpsrv binary with a malicious version, as first reported by Bleeping Computer.
The malware functions as a passive backdoor, remaining dormant until triggered by an attacker using a specifically crafted HTTP request. Researchers at XLab, the research arm of QiAnXin Technology Group, identified that the threat actor uses encrypted HTTP headers to execute commands while suppressing server logs to avoid detection. The backdoor employs AES-256-CBC encryption and RSA signatures to ensure secure communication and prevent unauthorized access. With over 340,000 instances of the web hosting administration tool exposed publicly, the potential impact is significant. The campaign appears linked to the Ebury botnet, which has compromised nearly 400,000 servers since 2009. Security experts advise administrators to inspect their systems for the ngx_http_integrity_helper socket and suspicious helper processes. If a compromise is detected, organizations should replace the malicious binary, update to the latest software version, and rotate all administrative credentials immediately. The discovery highlights the ongoing risks to Linux-based infrastructure and the importance of monitoring server binaries for unauthorized modifications.
Source: Bleeping Computer
