More than 340,000 CWP instances have been exposed on the public web over the past month, a scope that underscores how widely available the targeted attack surface is for a new Linux backdoor researchers are calling CWPdoor.
Scale: 340,000+ exposed CWP instances
CWP — formerly CentOS Web Panel — is an open-source web hosting administration solution that lets operators manage web servers and services such as email, DNS, and databases. Researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, report that more than 340,000 CWP instances were visible on the public internet over the last month, providing a large population of potentially vulnerable hosts for attackers to probe or infect.
Delivery: trojanized cwpsrv and a fake updater script
XLab discovered the campaign after capturing a script on June 29 that posed as an updater and replaced the legitimate cwpsrv binary — the web server process behind the Control Web Panel — with a malicious version. The script specifically targets cwpsrv versions 1.15.10 and 1.24.0. It takes multiple steps to conceal the swap, including restoring file and directory timestamps, deleting temporary files, and wiping the command-history log.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageOperation: encrypted commands, timestamp checks, and helper process
The backdoor sits dormant until it receives a specially crafted HTTP request. Operators send commands and retrieve output by embedding encrypted data in custom headers: the encrypted command is placed in X-Ngx-Integrity-Data, the timestamp in X-Ngx-Integrity-Time, and an RSA signature in X-Ngx-Integrity-Sig. Commands and responses are encrypted with AES-256-CBC. Before decrypting anything, CWPdoor checks that the timestamp falls within a ±300‑second window and verifies the RSA signature; only then is the ciphertext passed to a helper process for execution.
“Changing either the timestamp or the ciphertext independently invalidates the signature,” XLab explains. “By binding the three fields together and enforcing a ±300‑second time window, the mechanism provides replay protection and authorization control.”
Stealth: log suppression and socket artifacts to look for
XLab describes CWPdoor as “exceptionally stealthy” because it uses passive triggering and suppresses logging so the triggering request does not appear in access logs. The researchers recommend administrators look for specific indicators left by the trojanized binary, including the presence of an ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X‑Ngx‑Integrity strings embedded in the server binary.
If an operator confirms a compromise, XLab advises replacing the backdoored binary with a legitimate copy, upgrading to the latest version, rotating all control-panel credentials, and investigating the host for additional malware.
Evidence of active campaign and the unclear Ebury connection
After finding the initial infection script, XLab observed that CWPdoor was uploaded to VirusTotal on September 30 inside an archive that also included the Ebury backdoor. Crucially, the malicious cwpsrv file in that archive (named cwpsrv.suspeito) showed zero detections at the time — a sign, XLab says, that “the campaign was not merely experimental: real victims already exist in the wild.”
The connection between Ebury and CWPdoor remains unclear. The source notes Ebury is a long-running Linux backdoor and credential-stealing botnet operation active since at least 2009; a May 2024 report from ESET said Ebury had infected nearly 400,000 servers since it emerged. XLab stopped short of attributing CWPdoor to a known group and left the relationship to Ebury unresolved.
What this means for administrators, hosting providers, and incident responders
- Administrators: Check for the ngx_http_integrity_helper Unix socket, search binaries for X‑Ngx‑Integrity strings, and inspect cwpsrv helper processes. If you find indicators of compromise, replace the binary with a verified legitimate copy, upgrade, rotate control‑panel credentials, and hunt for further malware.
- Hosting providers and control‑panel operators: Prioritize inventorying exposed CWP instances and consider notifying customers of the specific IOCs XLab published. The wide internet visibility of CWP instances increases the urgency of patching or isolating vulnerable versions 1.15.10 and 1.24.0.
- Incident responders: Treat any detection of the custom headers, helper socket, or modified cwpsrv binary as evidence of high‑confidence compromise and expand investigations to credential theft and lateral movement, given the panel’s role in managing mail, DNS, and databases.
CWPdoor combines a targeted delivery mechanism, strong cryptographic protections for operator commands, and deliberate log suppression — a trio that makes detection difficult and remediation urgent. The presence of a VirusTotal archive containing both CWPdoor and Ebury, together with a malicious cwpsrv that initially escaped detection, leaves one clear operational question: how many compromised hosts remain hidden behind normal-looking control-panel operations? Administrators who run CWP should assume the possibility of stealthy compromise and act now to verify binaries, rotate credentials, and hunt for related artifacts.
