A newly identified Linux malware named CWPdoor is targeting servers running Control Web Panel (CWP) by replacing the legitimate cwpsrv web-server binary with a trojanized version. Researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, say the malware functions as a highly stealthy passive backdoor that activates only when attackers send specially crafted, cryptographically protected HTTP requests.
CWPdoor hides inside the CWP web server
CWP, formerly known as CentOS Web Panel, is an open-source web-hosting management solution similar to cPanel and Plesk. It allows administrators to manage web servers and services including email, DNS and databases.
XLab said more than 340,000 CWP instances were publicly exposed on the internet during the past month.
Researchers discovered CWPdoor on June 29 after capturing a script disguised as an updater. The script replaced the legitimate cwpsrv binary with a malicious version and targeted cwpsrv versions 1.15.10 and 1.24.0.
To conceal the replacement, the script restores file and directory timestamps, removes temporary files and clears command-history logs.
Source: XLab
Encrypted requests activate the backdoor
Operators activate CWPdoor by sending commands through encrypted HTTP headers. The command is placed in the X-Ngx-Integrity-Data header, while the request also contains a timestamp in X-Ngx-Integrity-Time and an RSA signature in X-Ngx-Integrity-Sig.
The command and its output are encrypted using AES-256-CBC. Before processing a request, the backdoor checks that its timestamp falls within a five-minute window and verifies the RSA signature. It then decrypts the command and passes it to a helper process for execution.
“Changing either the timestamp or the ciphertext invalidates the signature,” XLab explains.
“By combining three fields and enforcing a ±300 second time window, this mechanism provides replay protection and authentication control.”
The malware also interferes with the server’s logging module so that the request used to trigger the backdoor does not appear in the access log.
Source: XLab
Researchers find a possible connection to Ebury
After finding the initial infection script, researchers observed that CWPdoor had been uploaded to VirusTotal on September 30 in an archive containing the Ebury backdoor.
The archive drew attention because it included a malicious cwpsrv file named cwpsrv.sapate. No other files were found in the archive.
“This shows that this campaign was not just an experiment; real victims already exist in nature,” the researchers said. They added that the relationship between Everly and CWPdoor remains unclear.
Ebury is a Linux backdoor and credential-stealing botnet operation that has been active since at least 2009. In a May 2024 report, cybersecurity firm ESET said the malware had infected approximately 400,000 servers since it first emerged.
How administrators can check for CWPdoor
XLab recommends checking systems for suspicious ngx_http_integrity_helper Unix sockets, questionable cwpsrv helper processes and X-Ngx-Integrity strings embedded in server binaries.
If a compromise is confirmed, administrators should replace the backdoor binary with a legitimate copy, upgrade CWP to the latest version, rotate all Control Web Panel credentials and inspect the host for additional malware.
Source: www.bleepingcomputer.com