Researchers at QiAnXin’s XLab have disclosed CWPdoor, a stealthy Linux backdoor embedded in a trojanized version of cwpsrv, the web server that powers the Control Web Panel (CWP) administration interface.
The November 5 research report says the implant can execute attacker-supplied commands while suppressing the triggering request from access logs.
CWP is an open-source Linux server-management panel used to administer websites, DNS and email, in the same category as cPanel and WHM. XLab said more than 340,000 CWP instances were exposed to the internet during the preceding month, making them potential targets; it did not say that all, or any specific number, were infected.
XLab traced the malware to a script captured on June 29 that posed as a software updater and replaced the legitimate cwpsrv binary. The researchers observed trojanized builds targeting versions 1.15.10 and 1.24.0. The script also restored file timestamps and removed shell-history traces to conceal the replacement.
CWPdoor remains dormant during normal operation and activates only when a specially crafted HTTP or HTTPS request carries a timestamp, an AES-encrypted command and an RSA signature. The backdoor checks the timestamp against a five-minute window, verifies the signature, then passes the command to a helper process for execution. It encrypts the result and returns it in an HTTP response while suppressing the request’s normal access-log entry.
A September 30 VirusTotal upload from Brazil contained a CWPdoor sample that security products did not detect. XLab said this indicates real victims likely exist, but it has not established the number of compromised servers or the initial infection method. The researchers also said the relationship between CWPdoor and the Ebury backdoor found in the same archive remains unclear.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
