A hosting control panel is a high-value target for one obvious reason. Root access to the panel is root access to every website on the server.
Researchers at QiAnXin's XLab have found that someone took that idea further. They rebuilt the web server binary that runs Control Web Panel, a free Linux hosting panel, and inserted a backdoor directly into it.
They named it cwpdoor. It executes commands sent through web requests, and those requests never appear in the access logs.
What Makes This One Different
Most backdoors are extra files sitting on a server. They show up in directory listings, file-integrity scans, and antivirus signatures. cwpdoor is not an extra file. It is cwpsrv itself, rebuilt with additional code.
The researchers captured the installer on June 29. It was a shell script posing as a version update, and it handles only two versions of the web server: cwpsrv 1.15.10 and 1.24.0.
The backdoor behaves like the normal program until a request arrives carrying a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. Then it runs whatever command the request carries.
The Timestomping Detail
Here is the part that defeats routine checks.
When the installer replaces the cwpsrv file, it resets the file's timestamps back to their original values. A quick ls or stat shows the file as unchanged. It looks like a binary that has not been touched.
When the researchers checked, the backdoored file had zero detections out of 63 on VirusTotal.
That combination is why this one matters. It defeats file-timestamp triage, and it defeats signature-based scanning.
Evidence That Victims Exist
On September 30, an archive containing a copy of the backdoor was uploaded to VirusTotal from Brazil. The researchers say that indicates real victims already exist in the wild.
They do not give a count of infected servers.
One thing they cannot explain yet is how attackers obtain the root access the installer requires. Installing cwpdoor takes root, which means the attackers must already control the server before they deploy it. That prerequisite suggests either a separate root-level compromise or a supply chain path the researchers have not identified.
The archive from Brazil also contained the Ebury malware, an OpenSSH backdoor and credential stealer active since at least 2009. The researchers say they do not know whether the two are related, and that different attackers may have planted them on the same server.
How to Check a Server for cwpdoor
XLab gives three checks, and they look at different layers of the system.
|
Check |
Command |
What You Are Looking For |
|
Socket |
ss -axp | grep integrity |
A result naming ngx_http_integrity_helper, the Unix socket the backdoor uses |
|
Process |
ps aux | grep cwpsrv |
Unexpected helper processes started by cwpsrv |
|
File |
strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity |
The backdoor's custom header names embedded in the binary |
The socket check is the one to run first. In the researchers' example, it found the backdoor on a server where the list of open ports looked completely normal.
That is the point. A network scan will not catch this. You have to look at the process table and the binary itself.
Indicators of Compromise
The published indicators:
- MD5: e505d4ffa21cf494a5dc2d7c8f4f1236 (installer script, cwpsrv_update.sh)
- MD5: 965aea67fb40de1bab5169ada993349f (backdoored cwpsrv 1.15.10)
- MD5: d3f4e95113d49ab3991b45e457bda75b (backdoored cwpsrv 1.24.0)
- IP: 136.0.141[.]71 (download server)
- URL: https://136.0.141[.]71/static/cwpsrv_update.sh
- URL: https://136.0.141[.]71/static/cwpsrv_1.15.10
- URL: https://136.0.141[.]71/static/cwpsrv_1.24.0
Block the IP and the URLs at the network edge. Add the hashes to your detection platform.
Cleaning Up an Infected Server
The remediation has three steps, and none of them is optional.
- Restore the original cwpsrv binary. The installer creates a backup in /usr/local/cwpsrv/bin with a name starting cwpsrv.prev- and ending in a date and time. However, the researchers' description of the installer says it deletes "the temporary files and backup" after a successful swap. That copy may not exist.
- Upgrade to the latest version. Then confirm that ss -axp | grep integrity returns nothing.
- Change every control panel credential. The backdoor can run any command as root. Treat the whole server as compromised and check it for other threats.
That last step is not a formality. If cwpdoor was installed, the attacker had root. Everything on that machine is suspect.
Why Hosting Panels Are a Specific Problem
A control panel concentrates privilege. One compromised panel means every hosted site, every database, and every mailbox on that server is reachable.
That is exactly why attackers target panels rather than individual sites. The effort is the same, and the payoff is multiplicative.
For hosting providers, the practical implication is uncomfortable. A backdoor embedded in the panel binary itself defeats the integrity checks that most providers rely on, and it does so while leaving the file's metadata untouched.
The socket check is the fastest way to find it. Run it on every server you manage.
FAQ
What is cwpdoor?
A backdoor embedded directly into the cwpsrv binary that runs Control Web Panel. It executes commands sent through web requests carrying valid X-Ngx-Integrity headers, and those requests do not appear in the access logs.
How does it hide?
The installer resets the replaced file's timestamps to their original values, so ls and stat show nothing unusual. The binary also had zero detections out of 63 on VirusTotal when researchers checked.
Who found it?
Researchers at QiAnXin's XLab, who published their technical analysis this week.
Has it been used against real victims?
Yes. An archive containing a copy of the backdoor was uploaded to VirusTotal from Brazil on September 30, which the researchers say indicates real victims exist. They did not provide a count.
How did attackers get the root access needed to install it?
That is not yet known. Installing cwpdoor requires root, so the attackers must already control the server before deploying it.
How do I check my server?
Run ss -axp | grep integrity and look for ngx_http_integrity_helper. Also check ps aux | grep cwpsrv for unexpected helper processes, and run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity against the binary.
What if I find it?
Restore the original cwpsrv from the cwpsrv.prev- backup if it still exists, upgrade to the latest version, confirm the socket check returns nothing, and change every control panel credential. Treat the server as fully compromised.
Is this connected to Ebury?
Unknown. The VirusTotal archive also contained Ebury malware, but the researchers say different attackers may have planted them on the same server.
