CWPdoor Backdoor Hides Inside Control Web Panel's Own cwpsrv Web Server — Runs Only RSA-Signed Commands, Wipes Its Requests From Logs and Was Found Bundled With Ebury

High · 2026-11-06 · By H.A

CWPdoor Backdoor Hides Inside Control Web Panel's Own cwpsrv Web Server — Runs Only RSA-Signed Commands, Wipes Its Requests From Logs and Was Found Bundled With Ebury

Researchers found a trojanized cwpsrv binary that a fake updater script installs on Control Web Panel servers; it stays silent until it receives signed, encrypted HTTP headers, runs commands through a hidden Unix-socket helper and keeps those requests out of the access logs.

Overview

Security researchers have disclosed CWPdoor, a stealthy Linux backdoor hidden inside a trojanized copy of cwpsrv. That is the web server behind the management interface of Control Web Panel (CWP), formerly CentOS Web Panel. The implant sits passively inside a binary administrators trust and only acts when it receives a cryptographically signed HTTP request. It also edits the server's logging so those requests never appear in access logs.

Researchers counted more than 340,000 CWP instances exposed on the public internet over the past month, so the potential attack surface is large. One sample was found bundled with Ebury, the long-running Linux credential-stealing botnet. The relationship between the two is still unclear.

The Campaign

The infection starts with a shell script disguised as a CWP updater. The script:

Because the backdoored cwpsrv keeps serving the panel normally, administrators see no change in behaviour. The implant opens no listening port of its own and does not beacon out. It waits inside traffic the panel already receives.

Timeline

Tradecraft

Indicators of Compromise

Detection

Run the following read-only checks on CWP servers:

# Look for the backdoor's helper socket
ss -xlp | grep -i integrity_helper
find / -xdev -type s -name '*integrity_helper*' 2>/dev/null

# Search cwpsrv binaries for the custom header names
for f in $(find /usr/local/cwpsrv -type f -name 'cwpsrv*' 2>/dev/null); do
  strings "$f" | grep -q 'X-Ngx-Integrity' && echo "SUSPICIOUS: $f"
done

# Review process tree for unexpected cwpsrv children
ps -eo pid,ppid,user,cmd --forest | grep -A3 cwpsrv

Also check the host for Ebury, especially for tampered OpenSSH libraries and unusual SSH-related shared objects. If the access logs show no record of requests that your network logs or WAF did see, treat that gap itself as evidence.

Recommended Actions

  1. Run the checks above on every CWP server, starting with internet-exposed ones.
  2. If you find indicators, isolate the host, image it for forensics, replace cwpsrv with a clean vendor build or rebuild the server, and upgrade CWP to the latest release.
  3. Rotate all control-panel, root, SSH and hosted-site credentials, including database passwords and any API keys stored on the box.
  4. Restrict the CWP admin and user panel ports (2030/2031 for admin by default) to management IPs or a VPN.
  5. Monitor binary integrity with a file-integrity tool that hashes contents rather than trusting timestamps.

Analyst Assessment

CWPdoor fits a wider trend of attackers putting implants inside the management plane itself, which administrators rarely inspect. The signed-command design, timestamp restoration and log suppression all point to an experienced operator. The Ebury overlap suggests the backdoor may help attackers keep access on servers whose credentials were already stolen. CWP is widely used by budget and shared-hosting providers, often with little monitoring, so we expect CWPdoor infections to be under-detected. Hosting operators should treat any CWP server that has been internet-exposed and unaudited as possibly compromised until checked.

REEF SENTINEL