XLab finds CWPdoor, a passive Linux backdoor, in trojanised cwpsrv web server behind Control Web Panel

TLDR

• XLab says CWPdoor, a passive Linux backdoor, replaces cwpsrv, the web server behind Control Web Panel.¹²
• A disguised updater script swaps in cwpsrv 1.15.10 or 1.24.0 builds; how victims are reached is unknown.¹
• Admins should look for the ngx_http_integrity_helper socket, and if found, replace the binary and rotate all panel credentials.¹²

BleepingComputer reports that a new Linux malware called CWPdoor is being distributed through a trojanised version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.² The report comes from XLab, the research arm of QiAnXin Technology Group, which published its analysis on 5 November 2026.¹ XLab describes CWP as a free, open-source server management panel for CentOS and other Linux distributions, and cwpsrv as the web server dedicated to the panel's own interface.¹ XLab cites QiAnXin's Hunter Platform for more than 340,000 CWP instances exposed to the internet over the past month, which it calls potential targets.¹ Bulwark Black stresses that the figure describes potential exposure, not 340,000 infections.³

XLab says its threat analysis system captured a script named cwpsrv_update.sh on 29 June 2026.¹ The script, disguised as a version update, downloads a replacement binary from the server at 136.0.141[.]71 and supports only cwpsrv versions 1.24.0 and 1.15.10.¹ It must run as root, backs up the original file, stops the service, overwrites /usr/local/cwpsrv/bin/cwpsrv, restarts it and rolls back if a health check fails.¹ Whether it succeeds or fails, it restores the file and directory timestamps and runs history -d to delete the session's command history, so routine ls and stat checks show the file as unmodified.¹ XLab says the attacker inserted malicious code into the cwpsrv source and recompiled it, so the backdoor sits inside the legitimate server rather than running as separate malware.¹ The backdoor does nothing until it receives an HTTP request carrying three headers: X-Ngx-Integrity-Time, X-Ngx-Integrity-Data with an AES-256-CBC encrypted command, and X-Ngx-Integrity-Sig with an RSA signature.¹ It checks that the timestamp is within 300 seconds, verifies the signature against an embedded public key, then passes the command to a helper process and returns the encrypted output in an HTTP 200 response.¹ It also replaces the logging module's context for that request, so the request does not appear in access logs.¹

XLab says a file named evidencia.tgz was uploaded to VirusTotal from Brazil on 30 September 2026, containing libkeyutils.so.1.5.2, which most vendors identified as the Ebury backdoor, and cwpsrv.suspeito, the CWPdoor sample, which had zero detections.¹ XLab concludes that real victims already exist, but says the relationship between Ebury and CWPdoor is unclear and that the two could have been implanted by different attackers.¹ SC Media, summarising BleepingComputer, says the campaign appears linked to Ebury.⁴ XLab also says it does not know which vulnerability CWPdoor uses to spread, and Bulwark Black adds that the report does not establish how widely the implant has spread or that the CWP vendor's official distribution channel was compromised.¹³ Separately, SecurityOnline reports that VulnCheck disclosed ten flaws in CWP, fixed in versions 1.29 or 1.30, which it says have no confirmed exploitation; neither XLab nor SecurityOnline links them to CWPdoor.¹⁵

XLab's checks for an infected host are the Unix socket ngx_http_integrity_helper (ss -axp | grep integrity), suspicious helper processes under cwpsrv, and X-Ngx-Integrity strings in the cwpsrv binary.¹ Its recovery steps are to replace the malicious binary using the backup the script creates in /usr/local/cwpsrv/bin (named cwpsrv.prev- plus a timestamp), upgrade to the latest version, rotate all control panel credentials and treat the host as compromised.¹ BleepingComputer gives the same steps without the backup detail.² Bulwark Black advises preserving the suspect binary, process and socket information and centralised logs before cleanup, not relying on local panel access logs, taking replacement files only from a trusted source, and rebuilding the host if its integrity cannot be established.³

Why it matters: a replaced web server binary in a management panel lets an attacker run commands while its requests stay out of access logs, and XLab says affected hosts should be treated as compromised.¹