"Real victims already exist in the wild," QiAnXin's XLab researchers wrote, after finding a backdoored build of the Control Web Panel (CWP) web server that can execute arbitrary commands while leaving no record in access logs.
The implant: cwpsrv rebuilt as a backdoor
Researchers at QiAnXin's XLab discovered a backdoor they named "cwpdoor" embedded directly in the cwpsrv binary that runs Control Web Panel (CWP), a free Linux hosting control panel. The malicious binary behaves like the legitimate cwpsrv until it receives a specially formed web request containing a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. When such a request arrives, the backdoored server runs the command carried in the request.
The backdoor's design hides activity: requests that trigger command execution do not appear in the server's access logs, and when the installer replaces the cwpsrv file it restores the file timestamps so ls and stat show the file as unchanged. Installing the backdoor requires root access, the researchers noted, and they do not yet know how attackers obtain that root access on victim hosts.
Evidence, timelines, and telemetry
XLab captured the installer — a shell script masquerading as a version update — on June 29. The installer only targets two cwpsrv versions explicitly: 1.15.10 and 1.24.0. On September 30, an archive containing a copy of the backdoored binaries and the installer was uploaded to VirusTotal from Brazil; the researchers cite that upload as evidence that "real victims already exist in the wild" but did not provide a count of infected servers.
At the time XLab checked VirusTotal, the backdoored cwpsrv file had zero detections out of 63 engines. The archive uploaded from Brazil also contained the Ebury malware — an OpenSSH backdoor and credential stealer active since at least 2009 — but the researchers do not know whether Ebury and cwpdoor are related or whether different attackers placed them on the same server.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTechnical indicators published by XLab
XLab published file hashes, URLs, and an IP address associated with the campaign. The items listed by the researchers include:
- MD5 (installer script, cwpsrv_update.sh): e505d4ffa21cf494a5dc2d7c8f4f1236
- MD5 (backdoored cwpsrv 1.15.10): 965aea67fb40de1bab5169ada993349f
- MD5 (backdoored cwpsrv 1.24.0): d3f4e95113d49ab3991b45e457bda75b
- IP (download server): 136.0.141[.]71
- URLs: https://136.0.141[.]71/static/cwpsrv_update.sh, https://136.0.141[.]71/static/cwpsrv_1.15.10, https://136.0.141[.]71/static/cwpsrv_1.24.0
How to check a server for cwpdoor — the three XLab checks
XLab provides three practical checks administrators can run on a potentially infected host. All three rely on artifacts the researchers saw in their analysis:
- Socket: run ss -axp | grep integrity. A result naming ngx_http_integrity_helper, the Unix socket the backdoor uses, is a sign of infection.
- Process: run ps aux | grep cwpsrv and look for unexpected helper processes started by cwpsrv.
- File: run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity and look for the backdoor's header names embedded in the binary.
In XLab's example, the socket check revealed the backdoor on a server where the list of open ports otherwise looked normal — underlining that surface port scans alone may miss the implant.
Cleaning an infected server and practical constraints
XLab recommends three remedial steps for servers found to be infected:
- Restore the original cwpsrv from the installer's backup, if present, in /usr/local/cwpsrv/bin. The backup filename format starts with cwpsrv.prev- and ends with a date and time. The researchers caution that the installer description indicates it deletes temporary files and the backup after a successful swap, so that copy may be missing.
- Upgrade to the latest cwpsrv version and confirm that ss -axp | grep integrity returns nothing.
- Change all control panel credentials. Because the backdoor can run arbitrary commands, XLab advises treating the whole server as compromised and checking for additional threats.
What this means for server administrators, incident responders, and hosting providers
Server administrators who run Control Web Panel should run the XLab checks immediately, verify backups for a pre-infection cwpsrv binary, and rotate control-panel credentials if they find indicators. Incident responders will need to treat any infected host as fully compromised — the backdoor executes arbitrary commands and the implant may mask triggering requests from access logs. Hosting providers and managed service teams should note that the installer requires root to replace the cwpsrv binary, and XLab reports no current attribution for how that initial root was obtained.
The record XLab published is precise about what was found and what remains unknown: binaries rebuilt with malicious code, an installer posing as an update captured on June 29, a VirusTotal upload from Brazil on September 30, and traces that defenders can search for on disk, in process lists, and via sockets. The unanswered operational question the research leaves on the table is how attackers initially obtained the root privileges needed to swap in the backdoored cwpsrv — a gap that will determine whether this is an opportunistic post-compromise toolset or part of a broader, targeted intrusion campaign.
