Security researchers at XLab, part of QiAnXin Technology Group, have uncovered a previously unknown Linux backdoor named CWPdoor that spreads through a weaponized variant of cwpsrv, the underlying web server for Control Web Panel (CWP). The malware functions as a passive backdoor, remaining inactive on infected systems until an attacker delivers a specially formatted request to activate it.
Control Web Panel, formerly called CentOS Web Panel, is an open-source hosting management platform comparable to cPanel and Plesk. It enables administrators to oversee web servers and associated services including email, DNS, and database systems. XLab documented that over 340,000 CWP deployments have been exposed to the internet during the past month.
Discovery and distribution mechanism
The research team identified CWPdoor on June 29 after detecting a script masquerading as a software update. This script swapped the legitimate cwpsrv binary with its malicious counterpart, targeting versions 1.15.10 and 1.24.0. To conceal the substitution, the script restored file timestamps, removed temporary files, and cleared command history logs.
Activation and command execution
Attackers trigger the backdoor by transmitting commands through encrypted HTTP headers. The activation mechanism uses three components: an encrypted command payload in the X-Ngx-Integrity-Data header, a timestamp in X-Ngx-Integrity-Time, and an RSA signature in X-Ngx-Integrity-Sig. The malware encrypts both commands and responses using AES-256-CBC encryption.
Before executing any command, the backdoor validates that the timestamp falls within a five-minute window and confirms the RSA signature's authenticity. XLab notes that this design provides strong protections: Changing either the timestamp or the ciphertext independently invalidates the signature. By binding the three fields together and enforcing a ±300-second time window, the mechanism provides replay protection and authorization control.
The backdoor additionally suppresses logging by interfering with the server's logging module, ensuring that activation requests do not appear in access logs.
Connection to Ebury botnet
On September 30, researchers observed CWPdoor uploaded to VirusTotal within an archive that also contained the Ebury backdoor. The malicious cwpsrv binary in that archive, named cwpsrv.suspeito, showed zero detections at the time of discovery. The researchers state that This indicates that the campaign was not merely experimental: real victims already exist in the wild. However, the relationship between Ebury and CWPdoor remains unexplained.
Ebury is a long-running Linux backdoor and credential harvesting botnet that has operated since at least 2009. A May 2024 report from ESET indicated that the malware had compromised nearly 400,000 servers since its emergence.
Detection and remediation
XLab recommends that system administrators search for the ngx_http_integrity_helper Unix socket, unusual cwpsrv helper processes, and X-Ngx-Integrity strings within the server binary as indicators of compromise.
If infection is confirmed, administrators should take the following steps:
- Replace the compromised binary with a clean version from an official source
- Update to the most recent CWP release
- Reset all control panel user credentials
- Perform a thorough scan of the affected system for additional malware