Do Son 
more than 340,000 CWP instances were exposed to the internet over the past month
At a Glance
| Malware Family | cwpdoor backdoor (trojanized cwpsrv 64-bit Linux ELF binary for versions 1.15.10 and 1.24.0) |
| Threat Actor | Unattributed (found alongside the Ebury SSH backdoor in one Brazilian incident; connection unconfirmed) |
| Target / Victims | Linux servers running Control Web Panel (1 confirmed victim upload in Brazil; 342,591 exposed CWP instances tracked globally) |
| Delivery Vector | Fake update script (cwpsrv_update.sh) executed after attackers obtain root access through an unknown initial vector |
| Key Capabilities | Passive HTTP header activation, RSA-2048 signature verification, AES-256-CBC command encryption, access log suppression, timestamp restoration |
TL;DR
QiAnXin XLab researchers uncovered a passive cwpdoor backdoor compiled directly into the web server binary of Control Web Panel for Linux. Deployed through a fake root update script, the Control Web Panel cwpdoor backdoor executes encrypted commands hidden inside HTTP headers while erasing its own entries from server access logs. With more than 340,000 Control Web Panel servers exposed to the internet, the implant remained undetected by all 63 security engines on VirusTotal during initial testing.
Delivery and Attribution
On June 29, 2026, XLab’s threat monitoring system captured a malicious Bash script named cwpsrv_update.sh. This script fetched trojanized binaries from a remote server. Control Web Panel, formerly known as CentOS Web Panel, is a widely used Linux hosting interface powered by a custom Nginx web server called cwpsrv. According to QiAnXin Hunter Platform telemetry, 342,591 CWP instances were exposed online over a single month. The top countries were 91,641 hosts in the United States, 59,056 in France, and 34,301 in Germany.
Evidence of real-world compromises surfaced on September 30, 2026, when a user in Brazil uploaded an incident archive named evidencia.tgz to VirusTotal. That archive held a Linux shared library flagged by 25 engines as the Ebury OpenSSH backdoor. It also included a suspicious cwpsrv binary that had zero detections out of 63 scanners. Confirmed attribution to a known threat group does not exist. In addition, suspected attribution remains open. As the QiAnXin XLab research report notes, “The relationship between Ebury and cwpdoor remains unclear. It is possible that the two malware families were implanted on the same server by different attackers.”
Infection Chain
Researchers have not determined which vulnerability or credential theft method gives the attackers initial root access. Once the intruders hold root privileges, they run the cwpsrv_update.sh script. The script checks whether the local cwpsrv binary matches version 1.15.10 or 1.24.0 and downloads the corresponding trojanized ELF executable. Next, it backs up the genuine binary, stops the panel service, overwrites the executable in the cwpsrv bin folder, and restarts the server.
Anti-Forensic Cleanup
After restarting the service, the script verifies that the master, worker, and helper processes are running. If the check fails, the script rolls back the changes automatically; if it succeeds, the script deletes its temporary files and backup copy. Furthermore, the installer restores the original access and modification timestamps on both the binary and its parent folder before clearing the shell command history. As XLab explained, “As a result, under routine checks such as ls and stat, the replaced file appears as though it has “never been modified.””
Command-and-Control and Execution Behavior
Because the attackers compiled the cwpdoor backdoor straight into the Nginx-based cwpsrv source code, the server handles ordinary web traffic without opening any new TCP ports. During startup, an injected initialization routine locates the server’s internal logging module index. It also binds an abstract Unix domain socket named ngx_http_integrity_helper and spawns a child process titled “helper process.”
To trigger a command, the operator sends an HTTP or HTTPS request carrying three custom headers: X-Ngx-Integrity-Time, X-Ngx-Integrity-Data, and X-Ngx-Integrity-Sig. First, the master process checks that the timestamp falls within a 300-second window to block replay attempts. Second, it decodes an internal RSA-2048 public key masked with a 0x55 XOR byte. The master process then verifies the Base64 signature across the combined timestamp and data string. If either check fails, the server processes the packet as normal web traffic.
When verification succeeds, the master process derives an AES-256-CBC key from the SHA-256 hash of the RSA public key string and decrypts the command. It passes the plaintext instruction over the local Unix socket to the helper process, which runs the command via popen. Finally, the server returns the AES-encrypted output in an HTTP 200 response. It also tampers with the Nginx module context array to skip the logging module. Consequently, the Control Web Panel cwpdoor backdoor leaves zero records in the web access logs.
Defense and Detection Guidance
Because the implant opens no new network ports and suppresses web logs, port scans and log reviews will miss it. Instead, XLab advise administrators to check active Unix domain sockets, process trees, and binary strings. Defenders should inspect socket listings for ngx_http_integrity_helper, check running cwpsrv processes for an unexpected “helper process” child, and scan the cwpsrv binary for X-Ngx-Integrity header strings.
If an infection is confirmed, administrators should isolate the server, replace the modified binary with a verified clean build, and upgrade Control Web Panel to the latest release. Moreover, because the installer deletes its own backup copy upon success and requires prior root access, responders must audit the entire Linux host for secondary implants like Ebury. They must also rotate all panel, database, and SSH credentials from a clean workstation.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
