CWPdoor Backdoor Hides Inside Control Web Panel's Own cwpsrv Web Server — Runs Only RSA-Signed Commands, Wipes Its Requests From Logs and Was Found Bundled With Ebury

High · 2026-11-06 · By H.A

Researchers found a trojanized cwpsrv binary that a fake updater script installs on Control Web Panel servers; it stays silent until it receives signed, encrypted HTTP headers, runs commands through a hidden Unix-socket helper and keeps those requests out of the access logs.

Overview

Security researchers have disclosed CWPdoor, a stealthy Linux backdoor hidden inside a trojanized copy of cwpsrv. That is the web server behind the management interface of Control Web Panel (CWP), formerly CentOS Web Panel. The implant sits passively inside a binary administrators trust and only acts when it receives a cryptographically signed HTTP request. It also edits the server's logging so those requests never appear in access logs.

Researchers counted more than 340,000 CWP instances exposed on the public internet over the past month, so the potential attack surface is large. One sample was found bundled with Ebury, the long-running Linux credential-stealing botnet. The relationship between the two is still unclear.

The Campaign

The infection starts with a shell script disguised as a CWP updater. The script:

• replaces the legitimate cwpsrv binary (versions 1.15.10 and 1.24.0 were targeted) with the backdoored build
• restores the original timestamps on the file and its directory, so the swap does not stand out in file listings
• deletes temporary files and wipes the shell command history

Because the backdoored cwpsrv keeps serving the panel normally, administrators see no change in behaviour. The implant opens no listening port of its own and does not beacon out. It waits inside traffic the panel already receives.

Timeline

• 29 June 2026: researchers capture the fake updater script and discover CWPdoor.
• 30 September 2026: a CWPdoor sample appears on a public malware-scanning service inside an archive that also contains the Ebury backdoor. The malicious file, named cwpsrv.suspeito, has zero antivirus detections at that point.
• 5 November 2026: the researchers publish their analysis. They conclude the campaign is operational and likely has real victims.

Tradecraft

• Signed, time-boxed commands: the operator sends three custom headers: X-Ngx-Integrity-Data (the encrypted command), X-Ngx-Integrity-Time (a timestamp) and X-Ngx-Integrity-Sig (an RSA signature). The backdoor accepts a request only if the timestamp is within ±300 seconds and the signature is valid. This blocks replay and stops anyone else from taking over the implant.
• Encryption: commands and output are encrypted with AES-256-CBC.
• Helper process: decrypted commands go to a helper process over a Unix socket and are executed there, which keeps the main web server process looking clean.
• Log suppression: the logging module is altered so the triggering requests are never written to access logs.
• Ebury overlap: the sample's appearance alongside Ebury suggests the backdoor is used together with credential theft, or that the operators are the same. The researchers do not claim a firm link.

Indicators of Compromise

• Unix socket named ngx_http_integrity_helper
• Strings X-Ngx-Integrity-Data, X-Ngx-Integrity-Time, X-Ngx-Integrity-Sig inside the cwpsrv binary
• Unexpected child or helper processes of cwpsrv
• File name cwpsrv.suspeito
• cwpsrv binaries whose hash does not match a clean vendor build despite unchanged timestamps

Detection

Run the following read-only checks on CWP servers:

# Look for the backdoor's helper socket
ss -xlp | grep -i integrity_helper
find / -xdev -type s -name '*integrity_helper*' 2>/dev/null

# Search cwpsrv binaries for the custom header names
for f in $(find /usr/local/cwpsrv -type f -name 'cwpsrv*' 2>/dev/null); do
  strings "$f" | grep -q 'X-Ngx-Integrity' && echo "SUSPICIOUS: $f"
done

# Review process tree for unexpected cwpsrv children
ps -eo pid,ppid,user,cmd --forest | grep -A3 cwpsrv

Also check the host for Ebury, especially for tampered OpenSSH libraries and unusual SSH-related shared objects. If the access logs show no record of requests that your network logs or WAF did see, treat that gap itself as evidence.

Recommended Actions

1. Run the checks above on every CWP server, starting with internet-exposed ones.
2. If you find indicators, isolate the host, image it for forensics, replace cwpsrv with a clean vendor build or rebuild the server, and upgrade CWP to the latest release.
3. Rotate all control-panel, root, SSH and hosted-site credentials, including database passwords and any API keys stored on the box.
4. Restrict the CWP admin and user panel ports (2030/2031 for admin by default) to management IPs or a VPN.
5. Monitor binary integrity with a file-integrity tool that hashes contents rather than trusting timestamps.

Analyst Assessment

CWPdoor fits a wider trend of attackers putting implants inside the management plane itself, which administrators rarely inspect. The signed-command design, timestamp restoration and log suppression all point to an experienced operator. The Ebury overlap suggests the backdoor may help attackers keep access on servers whose credentials were already stolen. CWP is widely used by budget and shared-hosting providers, often with little monitoring, so we expect CWPdoor infections to be under-detected. Hosting operators should treat any CWP server that has been internet-exposed and unaudited as possibly compromised until checked.