Hackers Deploy CWPdoor Backdoor via Trojanized CWP Server

A new Linux malware called CWPdoor is distributed through trojanized versions of cwpsrv in the Control Web Panel web server, affecting over 340,000 exposed instances.

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. CWPdoor acts as a passive backdoor that sits dormant on the compromised system until the attacker sends a specially crafted request. Researchers at XLab discovered the malware on June 29 after capturing a script posing as an updater that replaced the legitimate 'cwpsrv' binary with a malicious version. The malware operators activate the backdoor by sending it commands to be executed in the form of an encrypted HTTP header. The backdoor checks whether the timestamp falls within a five-minute window and verifies the RSA signature before decrypting the command and passing it to a helper process for execution. The backdoor also interferes with the server’s logging module to prevent the triggering request from appearing in the access logs. More than 340,000 CWP instances have been exposed on the public web over the past month.