Security Researchers Expose Linux Backdoor CWPdoor Mimicking CWP Server Updates
Cybersecurity and privacy
Threat research team XLab revealed a novel Linux backdoor called CWPdoor. Attackers used a script named cwpsrv_update.sh to download a tampered Control Web Panel (CWP) binary under the guise of an update, wiping command histories and restoring timestamps to hide modifications. Triggered only via encrypted HTTP headers and RSA verification, the backdoor avoids idle anomalies and suppresses server logs. Over 340,000 exposed CWP instances worldwide are potentially targeted.
Threat research team XLab of Chinese cybersecurity firm Qi An Xin revealed on November 5 the discovery of CWPdoor, a novel Linux backdoor targeting servers running the open-source web hosting control tool Control Web Panel (CWP), with over 340,000 instances exposed online worldwide. Researchers initially spotted a suspicious script named cwpsrv_update.sh on June 29. Disguised as a legitimate software update, the script downloads a tampered cwpsrv binary to replace the original program, masking modifications by restoring file timestamps, deleting temporary files, and clearing shell command histories. CWPdoor is not a standalone executable and exhibits no abnormal activity during idle states. It functions only after receiving HTTP requests containing specific encrypted headers verified by timestamps and RSA signatures, subsequently decrypting attack commands executed via auxiliary utilities for remote control. Additionally, it interferes with server logging modules to conceal backdoor requests. XLab also found that an archive containing CWPdoor was uploaded to VirusTotal on September 30 without detection by any antivirus engine at the time, leading researchers to assess that real-world infections may have already occurred.
Key takeaways
- Attackers disguised cwpsrv_update.sh as a software update to replace legitimate cwpsrv executables, wiping command histories and temporary files to hide traces.
- The CWPdoor backdoor remains dormant until triggered by HTTP requests verified via encrypted headers, timestamps, and RSA signatures, while tampering with server logs.
- Researchers highlighted that over 340,000 CWP instances are exposed online worldwide, and a sample uploaded to VirusTotal on September 30 initially went undetected by all antivirus engines.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.