CWPdoor: Trojanized cwpsrv Binary Gives Attackers Root on 340,000 Linux Servers

The installation flow begins with cwpsrv_update.sh executing as root on the target. The script reads the installed CWP version string and immediately exits if the version does not match 1.15.10 or 1.24.0 -- the two builds for which the attacker prepared a recompiled backdoored binary. For matching versions, the script downloads the backdoored binary from 136.0.141.71 using curl or wget, writes it to /usr/local/cwpsrv/bin/cwpsrv, then executes a touch command that restores the original file's access time and modification time to their pre-replacement values. File system integrity checkers comparing timestamps will find no anomaly.

The cwpsrv binary serves a dual purpose after replacement. It handles legitimate web panel traffic identically to the unmodified build while simultaneously scanning every incoming HTTP request for a custom header. The trigger mechanism uses RSA asymmetric cryptography: the attacker signs a command payload with a private key, embeds the signature in an X-Ngx-Integrity header, and sends the request to the server. The backdoor verifies the RSA signature and checks that the timestamp in the header falls within a five-minute window of current server time. Both checks must pass before the payload decrypts. This design prevents replay attacks -- a captured trigger request cannot be reused more than five minutes later -- and ensures that only the operator holding the private signing key can issue commands.

The final evasion layer sits in cwpsrv's logging module. CWPdoor intercepts the logging call that would normally write the triggering request to the web server's access log and suppresses the entry before it reaches disk. From an access log perspective, the trigger request never arrived. The combined effect -- unchanged timestamps, zero AV signatures, and suppressed logs -- means that standard defensive telemetry provides no alert.

CWPdoor installs as a persistence mechanism after initial compromise, not as the initial exploit. The attacker first needs root access through a separate vulnerability or credential compromise. Once that foothold is established, the attack chain proceeds through five stages that collectively result in a deniable, persistent backdoor that survives server reboots and CWP service restarts.

The binary replacement technique maps directly to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) and T1036.005 (Masquerading: Match Legitimate Name or Location). The timestamp restoration aligns with T1070.006 (Indicator Removal: Timestomp). Command decryption maps to T1140 (Deobfuscate/Decode Files or Information) and execution through the trigger aligns with T1059.004 (Command and Scripting Interpreter: Unix Shell) and T1562.006 (Impair Defenses: Indicator Blocking).

The sophistication of the RSA signing requirement is notable. Most opportunistic Linux backdoors use simple authentication mechanisms -- hardcoded passwords, plaintext keys stored in the binary, or no authentication at all. CWPdoor's RSA-with-timestamp design requires the attacker to hold a private signing key and generate fresh signatures per command, adding operational security at the cost of deployment complexity. This pattern is consistent with an operator who expected their infrastructure to remain active for an extended period and needed to protect already-deployed backdoors from hijacking by other threat actors.

Control Web Panel is deployed predominantly on CentOS, Rocky Linux, AlmaLinux, and similar RHEL-derivative distributions. It is a full-featured hosting control panel managing web servers, email, DNS, databases, and system users from a single interface. Because of this breadth of system access, cwpsrv runs with root privileges on most deployments.

XLab's internet-facing scan identified more than 340,000 CWP instances publicly reachable over a 30-day measurement period. Confirmed compromises stand at over 2,000 servers, but XLab notes that the log-suppression design makes passive identification difficult: standard log review will not surface CWPdoor activity, and the zero antivirus detection rate means endpoint protection products provide no independent signal. The true infection count is unknown.

The same VirusTotal archive that contained the CWPdoor installer also contained a sample of Ebury, an SSH credential stealer linked to a financially motivated criminal group that has targeted Linux hosting infrastructure since 2009. The co-presence suggests possible operational overlap between CWPdoor operators and Ebury's operators, though XLab explicitly notes this connection is unconfirmed. If CWPdoor is confirmed on a server, check for Ebury indicators simultaneously.

The campaign's target selection -- specifically two of the most common CWP production versions -- and the RSA-signed command protocol indicate a threat actor with operational security sophistication beyond opportunistic mass exploitation. Version-specific recompiled binaries require preparation and testing against those exact builds. The operators chose not to use a generic binary dropper or a simple shell listener, trading easy deployment for resistance to analysis and hijacking.

The CWPdoor campaign's confirmed indicators are specific but not exhaustive. Because the attackers recompile the binary, additional samples with different hashes may exist beyond XLab's published values. Hash matching confirms known samples; a negative hash result does not confirm a clean binary. Behavioral indicators -- the Unix socket and HTTP header pattern -- are more reliable detection signals than hashes alone.

Block 136.0.141.71 at your perimeter firewall to prevent download of new backdoored binaries. This does not affect already-deployed backdoors but stops fresh installations on newly compromised hosts. Any outbound connections from cwpsrv to external IP addresses warrant investigation, as legitimate cwpsrv does not make outbound connections during normal operation.

The ngx_http_integrity_helper Unix socket is the most decisive host-based indicator. Run ss -xlp | grep ngx_http_integrity_helper on any CWP server: a non-empty result confirms an active CWPdoor infection regardless of binary hash. The X-Ngx-Integrity HTTP header pattern is the network-layer trigger; WAF rules blocking requests containing this header prevent remote command execution through an already-installed backdoor and provide detection telemetry for identifying servers under attack.

Two rules cover CWPdoor's most observable behaviors: file replacement at the cwpsrv binary path and presence of the X-Ngx-Integrity activation header in HTTP traffic. Both carry experimental status -- validate log source availability in your environment before enabling automated blocking.

The first action is verifying whether the cwpsrv binary has been replaced, which takes under two minutes on any system with md5sum installed. All further remediation depends on this result. If the hash matches a known backdoored build, treat the entire server as compromised -- not just the CWP service -- because the backdoor's root-level execution means every credential and file on the system must be treated as potentially accessed.

A "can't patch today" note: if the server cannot be taken offline for a full rebuild, the minimum interim steps are to verify and replace the binary, block 136.0.141.71 at the upstream firewall, and immediately rotate all credentials. These steps reduce ongoing risk but are not a substitute for a full rebuild from known-good media.

Most urgent if you operate CWP versions 1.15.10 or 1.24.0 on internet-exposed Linux servers, run shared hosting environments where multiple tenants' data is at risk, or manage VPS fleets where cwpsrv runs with root privileges on hundreds of hosts.

These steps apply if the binary hash check or socket check confirms CWPdoor is active on your server. CWPdoor operates at root level, so the response must treat the entire system as compromised, not only the CWP service.

Hosting providers managing hundreds or thousands of tenant servers face a specific challenge with CWPdoor: the attack operates entirely within a process that must run with root privileges for legitimate reasons. Standard privilege separation techniques do not apply because CWP's architecture requires root access to provision web server configurations, manage system users, and handle DNS changes. The process you cannot sandbox is the one that is backdoored.

The scale of CWP's public exposure -- 340,000+ internet-facing instances -- reflects how common it is in the budget and mid-market hosting segment. Many of these deployments run on under-resourced VPS instances where endpoint detection agents, file integrity monitoring, and centralized log aggregation are absent. Attackers who compromise such servers through credential stuffing, known vulnerabilities in upstream software, or phishing for server credentials gain access to environments where the only barrier between initial access and persistent backdoor installation is the absence of the installer script.

The connection to Ebury is significant for hosting operators specifically. Ebury's operators have targeted Linux hosting providers since at least 2014, using SSH credential harvesting to pivot from compromised server to compromised server within shared infrastructure. If CWPdoor's operators are related to Ebury's, the exposure surface extends beyond the CWP panel to every SSH key and credential on a compromised server and potentially to other servers in the same hosting environment.

For comparison, the GhostAction supply chain campaign followed a similar pattern of attacker-controlled update mechanisms used to compromise developer infrastructure at scale. The common thread is that software update paths represent trusted execution contexts that bypass most security controls -- binary signing and integrity verification at update time are the only reliable defenses.