CWPdoor Backdoor Hides in a Trojanized CWP Web Server

A Linux backdoor called CWPdoor is being delivered inside a tampered copy of cwpsrv, the web server that runs the Control Web Panel (CWP) management interface. Anyone running that panel on an exposed host has reason to check it.

Why a tampered web server is a useful hiding place

CWP, formerly CentOS Web Panel, is an open-source tool for administering web hosting. It works much like cPanel and Plesk. Users run their web servers through it, along with services including email, DNS and databases. XLab, the research arm of QiAnXin Technology Group, says more than 340,000 CWP instances have been reachable from the open internet during the past month.

The malicious file takes the place of the real cwpsrv binary. XLab calls the result "exceptionally stealthy", citing its passive triggering and log suppression.

How the backdoor stays quiet

CWPdoor is passive. It lies dormant until the operator sends a specially crafted request. The command travels in an encrypted HTTP header named X-Ngx-Integrity-Data, next to headers for a timestamp and an RSA signature. Commands and their output are protected with AES-256-CBC encryption.

Before acting, the backdoor checks that the timestamp falls inside a five-minute window and that the signature is valid. Only then does it decrypt the command and hand it to a helper process. XLab explains that changing the timestamp or the ciphertext alone breaks the signature, so the design gives replay protection and authorization control.

It also interferes with the server's logging module. The triggering request never shows up in the access logs.

Discovery, a zero-detection sample and the Ebury question

XLab found CWPdoor on June 29, when it captured a script posing as an updater. The script swaps in a malicious cwpsrv in versions 1.15.10 and 1.24.0. To hide the swap it restores file and directory timestamps, deletes temporary files and wipes the command-history log.

On September 30 the researchers saw CWPdoor uploaded to VirusTotal in an archive that also held the Ebury backdoor. The malicious file, named cwpsrv.suspeito, had zero detections. XLab concludes the campaign was not merely experimental and that real victims already exist. How Ebury and CWPdoor are connected is unclear.

Ebury is a botnet operation that steals credentials and gives backdoor access to Linux servers. It has been active since at least 2009. ESET reported in May 2024 that it had infected nearly 400,000 servers.

What administrators should do

XLab advises administrators to look for three signs: the ngx_http_integrity_helper Unix socket, odd cwpsrv helper processes, and X-Ngx-Integrity strings inside the server binary.

If a compromise is confirmed, swap the backdoored binary for a clean copy and move to the newest release. Every control panel credential should then be changed, and the host searched for other malware.

Source: BleepingComputer