Researchers uncover stealthy backdoor hidden in CWP binaries

QiAnXin XLab researchers identified cwpdoor, a backdoor embedded in trojanised 64-bit Linux binaries for Control Web Panel (CWP) versions 1.15.10 and 1.24.0. The researchers detected a malicious script, cwpsrv_update.sh, on 29 June 2026. It requires attackers to have already gained root access, though XLab has not established how they obtain it. The script replaces the panel’s cwpsrv executable with a matching infected version. XLab telemetry counted 342,591 CWP instances exposed online in one month; this is an exposure figure, not a count of infected servers.

Evidence of a real-world incident emerged on 30 September 2026, when a user in Brazil uploaded an archive to VirusTotal containing a suspicious cwpsrv binary and a library identified as the Ebury OpenSSH backdoor. The cwpsrv binary received no detections from 63 scanners. XLab said the relationship between cwpdoor and Ebury is unclear, and attribution remains unconfirmed.

The backdoor does not open an additional network port. It waits for HTTP or HTTPS requests containing three custom headers, verifies a timestamp and RSA-2048 signature, then decrypts commands with AES-256-CBC and runs them through a helper process. It returns encrypted output and alters logging so requests are omitted from web access logs. The installer also removes its temporary files and backup, restores file timestamps and clears shell history.

XLab advises checking for the named Unix socket, an unexpected helper process and the header strings in the cwpsrv binary. For confirmed infections, it recommends isolating the server, restoring a verified clean binary, upgrading CWP, checking the host for other implants and changing panel, database and SSH credentials from a clean workstation.