Hackers Backdoor Linux Servers with CWPdoor Trojan
First merged summary.
CWPdoor backdoor in trojanized CWP servers enables command execution without logs, affecting over 340,000 instances.
Researchers at XLab discovered CWPdoor, a Linux malware distributed via trojanized cwpsrv in Control Web Panel, on June 29. The backdoor activates through encrypted HTTP headers X-Ngx-Integrity-Data, executing commands after RSA signature verification within a five-minute window. It interferes with server logging to avoid detection. Real victims exist, with archives uploaded from Brazil. Restore from backups is recommended.
- CWPdoor replaces cwpsrv in versions 1.15.10 and 1.24.0
- Activates via encrypted HTTP header X-Ngx-Integrity-Data
- Checks RSA signature and timestamp within 5 minutes
- Interferes with server logging module
- Over 340,000 exposed instances affected
- Real victims confirmed
Timeline
dated events in the reporting · oldest first- Jun 29, 2026Installer captured containing CWPdoor · BleepingComputer
- Jun 29, 2026XLab discovers CWPdoor malware · The Hacker News
- Jun 29, 2026Backdoored archive uploaded from Brazil · The Hacker News
What each outlet adds
beyond the shared facts- BleepingComputerActivation details and logging interference, not experimental
- The Hacker NewsReal victims and Brazilian archive upload
- Vendors
- CWPQiAnXin's XLab
- Products
- cwpsrvControl Web Panel
- Organizations
- XLabQiAnXin Technology Group
Coverage
oldest first · one row per article · UTC- · 4d ago
BleepingComputerFirst report
Hackers Deploy CWPdoor Backdoor via Trojanized CWP Server
A new Linux malware called CWPdoor is distributed through trojanized versions of cwpsrv in the Control Web Panel web server, affecting over 340,000 exposed instances.
- · 3d ago
The Hacker News
Hackers hide backdoor in Control Web Panel server
cwpdoor backdoor in CWP allows command execution without logs; real victims exist.