QiAnXin researchers uncover stealth backdoor in Linux hosting panels

Researchers from QiAnXin’s XLab have disclosed a backdoor hidden inside the Linux hosting control panel known as Control Web Panel (CWP). The backdoored component, dubbed cwpdoor, operates by compromising the web server that runs CWP and then executing commands sent via web requests. These requests do not appear in the server’s access logs, and installation requires root access, implying the attacker already controls the target server.

The backdoor is a modified cwpsrv binary, rebuilt with extra code, and the installer for it masquerades as a version update. The installer specifically targets cwpsrv versions 1.15.10 and 1.24.0. On 29 June, the researchers captured the installer’s shell script, cwpsrv_update.sh, which performs the swap. A September 30 archive containing the backdoor was uploaded to VirusTotal from Brazil, suggesting that real victims are already in the wild, though no infected-server count is given.

The backdoor remains dormant until a request arrives with a valid timestamp and a signature in custom headers beginning with X-Ngx-Integrity; such a request then prompts cwpsrv to run the command embedded in the request. The cwpsrv binary is altered so that file dates are reset to their original values after replacement, making integrity checks like ls or stat unreliable.

The researchers provide three detecting checks: a socket named ngx_http_integrity_helper on ss -axp, a cwpsrv-related process appearing in ps aux, and strings in /usr/local/cwpsrv/bin/cwpsrv containing X-Ngx-Integrity header names.

They list these indicators: MD5 e505d4ffa21cf494a5dc2d7c8f4f1236 for cwpsrv_update.sh, MD5 965aea67fb40de1bab5169ada993349f for the backdoored cwpsrv 1.15.10, MD5 d3f4e95113d49ab3991b45e457bda75b for the backdoored cwpsrv 1.24.0, IP 136.0.141[.]71 (download server), and URLs https://136.0.141[.]71/static/cwpsrv_update.sh, https://136.0.141[.]71/static/cwpsrv_1.15.10 and https://136.0.141[.]71/static/cwpsrv_1.24.0.

For remediation, the researchers advise restoring cwpsrv from the installer’s backup in /usr/local/cwpsrv/bin (cwpsrv[.]prev-<date>), upgrading to the latest version and verifying no X-Ngx-Integrity activity remains, and changing all control panel credentials as the backdoor can execute arbitrary commands. They also note the Brazilian archive also contained Ebury malware, though it is unclear if related.