Hackers hide backdoor in Control Web Panel server
Original title: Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
cwpdoor backdoor in CWP allows command execution without logs; real victims exist.
Researchers at QiAnXin's XLab discovered a backdoor in Control Web Panel that executes attacker commands via web requests without appearing in access logs. Installer captured on June 29 handles versions 1.15.10 and 1.24.0. Archive uploaded from Brazil indicates real victims. Backdoor is rebuilt cwpsrv with hidden X-Ngx-Integrity headers.
Unconfirmed: How attackers obtain initial root access unknown
- Backdoor named cwpdoor
- Installer captured on June 29
- Archive uploaded from Brazil
- MD5 hashes for backdoored cwpsrv files
- Restore from backup recommended
- Vendors
- QiAnXin's XLab
- Products
- Control Web Panel
- Malware
- cwpdoor
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 136.0.141.71 | e95113d49ab3991b45e457bda75b (backdoored cwpsrv 1.24.0) IP: 136.0.141[.]71 (download server) URL: https://136.0.141[.]71/static/cwps |
| md5 | 965aea67fb40de1bab5169ada993349f | 4a5dc2d7c8f4f1236 (installer script, cwpsrv_update.sh) MD5: 965aea67fb40de1bab5169ada993349f (backdoored cwpsrv 1.15.10) MD5: d3f4e95113d49ab3991b45e457 |
| md5 | d3f4e95113d49ab3991b45e457bda75b | 67fb40de1bab5169ada993349f (backdoored cwpsrv 1.15.10) MD5: d3f4e95113d49ab3991b45e457bda75b (backdoored cwpsrv 1.24.0) IP: 136.0.141[.]71 (download ser |
| md5 | e505d4ffa21cf494a5dc2d7c8f4f1236 | ed normal. The researchers published these indicators: MD5: e505d4ffa21cf494a5dc2d7c8f4f1236 (installer script, cwpsrv_update.sh) MD5: 965aea67fb40de1ba |
From the original article
2 min read at thehackernews.com
A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.