Affected Systems

Control Web Panel (CWP) cwpsrv versions 1.15.10 and 1.24.0. CWP is a free Linux hosting management panel. Backdoor requires prior root access to install but enables persistent, log-free command execution via specially crafted HTTP requests.

Exploitation Status

Active exploitation confirmed. Backdoored sample uploaded to VirusTotal from Brazil on September 30, 2026. Installer script captured June 29, 2026. QiAnXin researchers state "real victims already exist in the wild." No public count of infected servers available.

Business Impact

Hosting providers and organizations running CWP face risk of persistent backdoor access that bypasses standard logging. Attackers can execute arbitrary commands as root without leaving traces in access logs, complicating detection and incident response. Initial compromise vector unknown—attackers need root access to deploy the backdoor, suggesting prior breach or credential compromise. Co-infection with Ebury OpenSSH backdoor observed in at least one case, indicating potential for multi-stage attacks or shared victim infrastructure.

Urgency

🔴 Immediate

Recommended Actions

  • Run detection checks immediately on all CWP servers: 'ss -axp | grep integrity' (look for ngx_http_integrity_helper socket), 'ps aux | grep cwpsrv' (check for unexpected helper processes), and 'strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity' (search for backdoor headers).
  • If infected, restore original cwpsrv binary from backup at /usr/local/cwpsrv/bin/cwpsrv.prev-* (if available), upgrade CWP to latest version, and verify 'ss -axp | grep integrity' returns no results.
  • Block outbound connections to 136.0.141[.]71 at network perimeter and check firewall/proxy logs for historical connections to this IP or URLs: http://136.0.141[.]71/static/cwpsrv_update.sh, /static/cwpsrv_1.15.10, /static/cwpsrv_1.24.0.
  • Hunt for installer script and backdoored binaries using MD5 hashes: e505d4ffa21cf494a5dc2d7c8f4f1236 (installer), 965aea67fb40de1bab5169ada993349f (cwpsrv 1.15.10), d3f4e95113d49ab3991b45e457bda75b (cwpsrv 1.24.0).
  • On confirmed infections, rotate all CWP credentials, conduct full server compromise assessment including checks for Ebury malware (OpenSSH backdoor), review authentication logs for initial root access vector, and consider full OS reinstall from known-good media.

---

# Threat Actor Context

Actor Profile

The threat actor behind the CWP backdoor (cwpdoor) remains unidentified. The actor demonstrates advanced capabilities in supply chain compromise and stealth techniques, targeting Control Web Panel (CWP) infrastructure. Motivation appears focused on persistent access to Linux hosting servers, likely for command execution, credential theft, or further compromise. The actor requires initial root access to deploy the backdoor, suggesting either exploitation of unpatched vulnerabilities, credential compromise, or supply chain insertion. Attribution is currently unknown, though the presence of Ebury malware (active since 2009) on at least one compromised server suggests possible connection to established cybercrime infrastructure, though researchers note different actors may have independently compromised the same targets.

TTPs (Tactics, Techniques, Procedures)

The actor employs sophisticated persistence and defense evasion techniques. Key TTPs include: T1554 (Compromise Client Software Binary) - trojanizing the cwpsrv web server binary itself with backdoor code targeting versions 1.15.10 and 1.24.0; T1036.005 (Masquerading: Match Legitimate Name or Location) - disguising the installer as a legitimate version update script (cwpsrv_update.sh); T1070.006 (Indicator Removal: Timestomp) - restoring original file timestamps after replacement to evade detection via ls/stat commands; T1059.004 (Command and Scripting Interpreter: Unix Shell) - executing arbitrary commands via custom HTTP headers (X-Ngx-Integrity) with timestamp and signature validation; T1562.001 (Impair Defenses: Disable or Modify Tools) - bypassing access log mechanisms to prevent request logging; T1573 (Encrypted Channel) - using custom integrity headers for command transmission. The backdoor communicates via Unix socket (ngx_http_integrity_helper) and requires valid cryptographic signatures for command execution.

Targets & Patterns

The campaign specifically targets organizations using Control Web Panel (CWP), a free Linux hosting management panel, focusing on web hosting providers and hosting infrastructure operators. Victims include servers running CWP with cwpsrv versions 1.15.10 and 1.24.0. At least one confirmed victim exists in Brazil (based on September 30, 2026 VirusTotal upload from Brazilian IP), though researchers indicate "real victims already exist in the wild" without providing specific counts. The targeting pattern suggests the actor seeks access to multi-tenant hosting environments where a single compromised server could provide access to numerous hosted websites and customer data. The requirement for initial root access indicates the actor either exploits pre-existing vulnerabilities in CWP installations, leverages stolen credentials, or compromises the software supply chain. The co-presence of Ebury SSH backdoor on at least one victim suggests targeting of high-value hosting infrastructure that may already be compromised by other threat actors.

Historical Context

The CWP backdoor represents a newly identified threat discovered by QiAnXin XLab researchers, with the installer first captured on June 29, 2026, and a backdoored sample uploaded to VirusTotal on September 30, 2026. No direct links to previous campaigns have been established. However, the co-occurrence of Ebury malware (an OpenSSH backdoor and credential stealer active since at least 2009) on at least one compromised server suggests potential overlap with long-running cybercrime infrastructure targeting Linux servers. Researchers have not confirmed whether the CWP backdoor and Ebury deployments are related or represent independent compromises by different actors. The backdoor's sophisticated evasion techniques (timestomping, log bypass, cryptographic validation) indicate an experienced actor, though this is the first public documentation of this specific malware family. The targeting of hosting management panels follows established patterns of supply chain and infrastructure compromise seen in other campaigns targeting shared hosting environments.

Defensive Recommendations

  • Monitor for suspicious Unix sockets using 'ss -axp | grep integrity' to detect ngx_http_integrity_helper socket indicative of cwpdoor infection (T1554)
  • Inspect cwpsrv binary for backdoor indicators using 'strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity' to identify custom header implementations
  • Implement file integrity monitoring (FIM) on /usr/local/cwpsrv/bin/cwpsrv to detect unauthorized binary modifications, even when timestamps are manipulated (T1070.006)
  • Block network communications to known malicious infrastructure: IP 136.0.141[.]71 and associated URLs serving cwpsrv_update.sh and backdoored binaries
  • Monitor for unexpected child processes spawned by cwpsrv using 'ps aux | grep cwpsrv' and establish process execution baselines for anomaly detection (T1059.004)
  • Deploy YARA rules or hash-based detection for known malicious files: MD5 e505d4ffa21cf494a5dc2d7c8f4f1236 (installer), 965aea67fb40de1bab5169ada993349f (backdoored 1.15.10), d3f4e95113d49ab3991b45e457bda75b (backdoored 1.24.0)
  • Audit all systems with root access for unauthorized modifications and rotate all CWP credentials on potentially compromised servers, treating entire infrastructure as compromised
  • Scan for co-occurring threats including Ebury SSH backdoor, as multiple malware families may target the same hosting infrastructure