Skip to content
Hacker Posts

CWPdoor backdoor replaces Control Web Panel's cwpsrv binary

XLab found CWPdoor, a passive backdoor shipped as a trojanized cwpsrv binary for Control Web Panel and triggered by crafted HTTP headers; over 340,000 CWP instances are internet-exposed.

Published 3 min read
malwarecwplinuxbackdoor

Researchers at XLab, the research arm of QiAnXin, documented CWPdoor — a passive backdoor shipped as a trojanized build of cwpsrv, the web server behind Control Web Panel (CWP, formerly CentOS Web Panel). A script posing as an updater swaps the legitimate binary for the malicious one, which then stays dormant until it receives a crafted HTTP request. XLab counts more than 340,000 CWP instances exposed on the public internet. The findings were reported by BleepingComputer; XLab's writeup is the primary source.

How the backdoor works

CWPdoor is passive: it does no beaconing and waits for a trigger request carrying three headers — X-Ngx-Integrity-Data, X-Ngx-Integrity-Time and X-Ngx-Integrity-Sig. It checks that the timestamp falls within a ±300-second window and verifies an RSA signature, then decrypts the command (AES-256-CBC) and hands it to a helper process. It tampers with the server's logging so the triggering request never appears in access logs. The installer script covers its tracks too: it restores file and directory timestamps, deletes temporary files and wipes the command-history log.

Delivery and timeline

The fake updater replaced cwpsrv on versions 1.15.10 and 1.24.0, per XLab, which captured the updater on 29 June 2026. On 30 September 2026 the backdoor — filename cwpsrv.suspeito — was uploaded to VirusTotal with zero detections, in an archive that also contained the Ebury backdoor; XLab says the link to Ebury is unclear. No threat actor is named, and the initial-access method is unconfirmed.

Indicators

XLab published no hashes, domains or IPs. The usable indicators are behavioral:

  • The filename cwpsrv.suspeito.
  • A Unix socket named ngx_http_integrity_helper.
  • Suspicious cwpsrv helper processes.
  • The X-Ngx-Integrity strings inside the server binary.

CWP's server fingerprint is well known, so operators can scope their exposed footprint:

Shodan: "Server: cwpsrv"

Action checklist

  1. Check for the ngx_http_integrity_helper socket, unexpected cwpsrv helper processes, and X-Ngx-Integrity strings in the running cwpsrv binary.
  2. If any are present, treat the host as compromised: replace the backdoored binary with a verified copy, rebuild or upgrade CWP to the current release, and rotate every control-panel credential.
  3. Investigate the host for additional implants — the VirusTotal archive bundled Ebury, a long-lived Linux server backdoor.
  4. Put CWP's admin interface behind a VPN or IP allowlist rather than exposing it to the internet.

Context

CWP has a long record of exploited server-side flaws — CVE-2022-44877 (OS command injection) reached CISA's KEV catalog, and CVE-2025-48703 (unauthenticated command injection in the file manager) followed. A trojanized cwpsrv is a different failure mode — the attacker is replacing the server, not exploiting it — but the common thread is the same: a widely exposed hosting panel with a large, under-monitored install base. If you run CWP, assume it's a target and monitor the binary itself, not just its CVEs.

Related stories