Affected Systems
Control Web Panel (CWP) Linux servers running cwpsrv versions 1.15.10 and 1.24.0. Over 340,000 CWP instances exposed on public internet. Trojanized cwpsrv binary replaces legitimate web server component with passive backdoor.
Exploitation Status
Active exploitation confirmed. Real victims identified in the wild. Malicious cwpsrv binary uploaded to VirusTotal on September 30, 2026 with zero detections. Initial infection script captured June 29, 2026. Possible connection to Ebury botnet operation.
Business Impact
Attackers gain persistent backdoor access to Linux web hosting servers via encrypted command execution. Malware suppresses access logs and uses passive triggering via specially crafted HTTP headers (X-Ngx-Integrity-Data), making detection difficult. Commands encrypted with AES-256-CBC and authenticated via RSA signatures. Compromised servers can execute arbitrary commands while evading standard logging. Web hosting providers and organizations using CWP for server management at immediate risk.
Urgency
🔴 Immediate
Recommended Actions
- Check all CWP servers for ngx_http_integrity_helper Unix socket and suspicious cwpsrv helper processes immediately
- Search cwpsrv binaries for X-Ngx-Integrity strings using grep or strings command to identify trojanized versions
- Replace any backdoored cwpsrv binaries with legitimate copies from official CWP sources and upgrade to latest version
- Rotate all Control Web Panel credentials including admin, database, and service accounts on affected systems
- Scan for Ebury backdoor and other secondary malware on compromised hosts; review command history and access logs for anomalies
- Monitor HTTP traffic for X-Ngx-Integrity-Data, X-Ngx-Integrity-Time, and X-Ngx-Integrity-Sig headers on CWP servers