A stealthy backdoor has been identified in the Control Web Panel (CWP) server software, enabling attackers to execute commands without triggering any access logs. The malicious code, dubbed “cwpdoor” by cybersecurity researchers, resides in the core web server binary of CWP and activates only when it encounters specially-crafted HTTP requests adorned with custom headers. These header names start with “X-Ngx-Integrity,” signaling deviant behavior to anyone familiar with normal operations.
What’s the Threat?
CWP is a free web hosting control panel used to manage Linux-based servers. To implant this backdoor, attackers must first gain root-level access—indicating that the servers are already compromised during the initial intrusion. The backdoor remains dormant until it receives a valid timestamp and signature in the malicious headers, at which point it executes commands received via the web request. Crucially, none of these injected requests ever show up in the server’s access logs, making detection significantly harder.
Discovery and Technical Details
Security researchers at QiAnXin’s XLab uncovered the threat earlier this year when they captured the malicious installer script—disguised as a regular version update—on June 29. The script targets only two versions of cwpsrv: 1.15.10 and 1.24.0. The researchers are still investigating how attackers achieve the initial root access required to deploy the backdoor.
On September 30, a backdoored copy of cwpsrv was uploaded to VirusTotal from Brazil, confirming that there are active victims in the wild. The backdoored server binaries perform normally unless they detect the special header pair, upon which they run hidden commands. Further obfuscation is achieved by preserving original file timestamps after installation, hiding the code swap from file inspection tools like “ls” or “stat.” Notably, none of the two infected cwpsrv binaries raised alerts on VirusTotal.
Indicators & Mitigations
Three checks can help system administrators determine if their CWP servers are compromised:
- Run “ss ‐axp | grep integrity” to see if a Unix socket called ngx_http_integrity_helperis present.
- Inspect running processes for unexpected helpers spawned by cwpsrv using “ps aux | grep cwpsrv.”
- Search inside the binary with
strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrityto see if the custom header names are embedded in the executable.
To clean an infected server, administrators should:
- Restore the original cwpsrv binary from backups (named like
cwpsrv.prev-*), if available. - Upgrade to the latest version and verify that the integrity socket is gone.
- Change all control panel credentials and assume full server compromise—search for other malicious tools or intruders.
An unrelated but concerning find: the Brazilian-uploaded archive also included Ebury malware, a long-active OpenSSH backdoor and credential-stealer. It’s unclear whether the same attacker deployed both threats.
What this means is that even free, commonly-used infrastructure tools like CWP can harbor deeply hidden threats if compromised. Server operators should audit their systems using the checks above, make regular backups, keep software up to date, and assume that any root-level breach may lead to multiple layers of intrusion. Vigilance and proper incident response planning are key to defending against such silent, sophisticated attacks.
