CWPdoor: Trojanized Control Web Panel cwpsrv binary backdoors Linux servers

Key facts for CWPdoor Control Web Panel backdoor

Detection coverage for CWPdoor Control Web Panel backdoor

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5330 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CWPdoor — Fake cwpsrv Update Script Execution and cwpsrv Binary Replacement

Detects the CWPdoor installation chain on Linux Control Web Panel hosts: execution of the masquerading cwpsrv_update.sh script, any command line touching the CWPdoor staging server 136.0.141.71, and cp/mv/install/curl/wget writing to /usr/local/cwpsrv/bin/cwpsrv (the trojanized cwpsrv_1.15.10 / cwpsrv_1.24.0 builds). Behaviour-first: fires on the replacement of the panel web server binary, not on a single hash.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1554, T1105, T1036, T1059.004
• Data sources: sysmon_for_linux, index=linux sourcetype=sysmon:linux EventID=1
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventID=1 earliest=-24h | eval cmd=coalesce(CommandLine,""), img=coalesce(Image,"") | where like(cmd,"%cwpsrv_update.sh%") OR like(cmd,"%136.0.141.71%") OR (match(img,"/(cp|mv|install|curl|wget)$") AND like(cmd,"%/usr/local/cwpsrv/bin/cwpsrv%")) | stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands values(ParentImage) as parent_images by host, User | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ('cwpsrv_update.sh', '136.0.141.71')
    or (FileName in~ ('cp', 'mv', 'install', 'curl', 'wget') and ProcessCommandLine has '/usr/local/cwpsrv/bin/cwpsrv')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: CWPdoor Fake cwpsrv Update Script or Binary Replacement
id: 7c1d3a52-4b8e-4f0a-9d21-6e5a0b3c8f11
status: experimental
description: Detects execution of the cwpsrv_update.sh installer, references to the CWPdoor staging server 136.0.141.71, or tools overwriting /usr/local/cwpsrv/bin/cwpsrv.
references:
  - https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/
  - https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.persistence
  - attack.t1554
  - attack.command-and-control
  - attack.t1105
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: linux
detection:
  selection_script:
    CommandLine|contains: 'cwpsrv_update.sh'
  selection_ip:
    CommandLine|contains: '136.0.141.71'
  selection_replace:
    Image|endswith:
      - '/cp'
      - '/mv'
      - '/install'
      - '/curl'
      - '/wget'
    CommandLine|contains: '/usr/local/cwpsrv/bin/cwpsrv'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrator manually upgrading or restoring cwpsrv from the vendor
level: high

Known false positives:

• Administrator manually upgrading or restoring the cwpsrv binary from the official CWP vendor
• Configuration-management or backup jobs that copy files under /usr/local/cwpsrv/bin

Tuning notes: Adjust index/sourcetype to your Sysmon-for-Linux or auditd execve ingestion. Allow-list the official CWP updater parent process and known change-window admin accounts; keep the 136.0.141.71 and cwpsrv_update.sh clauses unfiltered since they are near-zero-FP.

• 🔒 CWPdoor — Trojanized cwpsrv Binary and Installer File Writes (Defender for Endpoint) · unlock with TL Creds
• 🔒 CWPdoor — cwpsrv Spawning Shells or Helper Executing Commands (Defender for Endpoint) · unlock with TL Creds
• 🔒 CWPdoor — Connections to Staging Server [indicator] or cwpsrv Public Outbound (Defender for Endpoint) · unlock with TL Creds
• 🔒 CWPdoor — curl/wget Download of [indicator] or Trojanized cwpsrv from [indicator] · unlock with TL Creds
• 🔒 CWPdoor — Trojanized cwpsrv Process Started with Known MD5 Hash · unlock with TL Creds
• 🔒 CWPdoor — Successful Backdoor Command Exchange (All Three Headers plus octet-stream Response) · unlock with TL Creds
• 🔒 CWPdoor — Post-Install Anti-Forensics (Timestomp, Installer Cleanup, History Wipe) · unlock with TL Creds
• 🔒 CWPdoor — X-Ngx-Integrity Trigger Headers in HTTP Traffic · unlock with TL Creds

Indicators of compromise for CWPdoor Control Web Panel backdoor

As of 2026-11-05, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5330.

Sample indicators (3 of 17)

• IP address: 136.0.141[.]71
• File hash: e505d4ffa21cf494a5dc2d7c8f4f1236
• File hash: 965aea67fb40de1bab5169ada993349f

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How CWPdoor Control Web Panel backdoor works

XLab reports 340,000+ CWP instances exposed on the public web.

XLab (QiAnXin) documented CWPdoor, a parasitic backdoor living inside the cwpsrv binary of Control Web Panel (formerly CentOS Web Panel), an nginx-based Linux hosting control panel. The malicious script cwpsrv_update.sh, captured on 2026-06-29, masquerades as a legitimate cwpsrv version update. It requires root, backs up the original binary, replaces /usr/local/cwpsrv/bin/cwpsrv with a trojanized build downloaded from 136.0.141.71 (variants cwpsrv_1.15.10 and cwpsrv_1.24.0), restores the new binary's atime/mtime and its parent directory's timestamp, deletes temporary files and runs history -d to erase command history.

The trojanized cwpsrv behaves as the legitimate service until it receives an HTTP/HTTPS request carrying three headers: X-Ngx-Integrity-Time (timestamp, validated within a +/-300 second window), X-Ngx-Integrity-Data (Base64 AES-256-CBC ciphertext holding the command, IV in the first 16 bytes) and X-Ngx-Integrity-Sig (Base64 RSA signature over '<timestamp>:<ciphertext>'). A 2048-bit RSA public key is embedded in the binary XOR-encrypted with 0x55; the AES key is derived from the SHA-256 digest of the RSA public key string. Because commands must be signed with the operator's private key, the backdoor cannot be triggered by third parties, and signature binding of timestamp plus ciphertext provides replay protection.

The master process hooks the request path at the ngx_http_process_request entry point. Valid commands are handed to a helper child process over a Unix domain socket named ngx_http_integrity_helper, which executes them and returns the encrypted output as an HTTP 200 response with Content-Type application/octet-stream. To remain invisible, the backdoor copies and tampers with the request's module context array, replacing the context pointer of the logging module so triggering requests never reach access logs. The sample was uploaded to VirusTotal from Brazil on 2026-09-30 (as evidencia.tgz / cwpsrv.suspeito) with zero detections.

The archive also contained the Ebury backdoor; the relationship between CWPdoor and Ebury is unclear and XLab suggests it may reflect separate actors compromising the same systems. Ebury operators previously abused CWP in November 2020 to deploy Ebury. No CVE or CVSS has been assigned; severity is analyst-assigned. The initial infection vector used to run the update script on victim hosts is not described in the available sources. Defenders should check for the ngx_http_integrity_helper socket, X-Ngx-Integrity strings in the cwpsrv binary and unexpected helper processes, replace the binary with a legitimate one, upgrade CWP, rotate panel credentials and hunt for additional malware (including Ebury).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.003 Clear Command History; T1070.004 File Deletion; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1205 Traffic Signaling; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography

Initial Access

T1195.002 Compromise Software Supply Chain

Persistence

T1554 Compromise Host Software Binary

defense-impairment

T1685 Disable or Modify Tools

Remediation for CWPdoor Control Web Panel backdoor

Patches

• Upgrade Control Web Panel to the latest version from the official vendor

Immediate actions

• Check for the ngx_http_integrity_helper Unix socket: ss -axp | grep integrity
• Search the server binary for backdoor strings: strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity
• Inspect cwpsrv processes for suspicious helper child processes: ps aux | grep cwpsrv
• Block outbound and inbound traffic to 136.0.141.71
• Replace the compromised cwpsrv binary with a legitimate version

Workarounds

• Rotate control panel credentials and any credentials accessible from the affected host
• Alert on HTTP requests containing X-Ngx-Integrity-Data, X-Ngx-Integrity-Time or X-Ngx-Integrity-Sig headers where traffic is inspectable

Longer-term hardening

• Restrict CWP admin and user panel ports to trusted networks or a VPN rather than exposing them to the internet
• Verify integrity of cwpsrv and other panel binaries against known-good hashes and vendor sources only
• Investigate hosts for additional malware, including Ebury, and consider rebuilding compromised servers
• Do not run update scripts from unofficial sources as root

Affected and fixed versions

• Control Web Panel (CWP) — cwpsrv web server (nginx-based)
  Vulnerable versions: Trojanized cwpsrv builds 1.15.10 and 1.24.0 installed via cwpsrv_update.sh
  Fixed in: Replace with legitimate cwpsrv binary / upgrade to latest CWP release

Timeline of CWPdoor Control Web Panel backdoor

• 2009-01-01 locked-ioc-17 backdoor/credential-stealer botnet active since at least 2009 (year-level date per BleepingComputer); later found alongside locked-ioc-16 in the same VirusTotal archive.
• 2020-11-01 locked-ioc-17 operators exploited Control Web Panel to deliver and execute a Perl script installing locked-ioc-17 (per ESET); a prior precedent of CWP abuse for server backdooring (month-level date per source).
• 2024-05-01 ESET report 'locked-ioc-17 is alive but unseen' stated locked-ioc-17 had infected nearly 400,000 servers since it emerged (month-level date per BleepingComputer).
• 2026-06-29 XLab captured the malicious locked-ioc-12 script that installs the trojanized cwpsrv binary from locked-ioc-15.
• 2026-09-30 Archive locked-ioc-14 containing the sample (locked-ioc-13) was uploaded to VirusTotal from Brazil with zero detections; the archive also included locked-ioc-17.
• 2026-11-05 XLab (QiAnXin) published its locked-ioc-16 analysis, reporting 340,000+ exposed CWP instances; BleepingComputer covered the findings the same day.

Sources cited for CWPdoor Control Web Panel backdoor

• CWPdoor: The Invisible Backdoor Living Inside Control Web Panel (XLab) blog.xlab.qianxin.com · Research · 2026-11-05
• Beware of CWPdoor: zero-detection passive backdoor in CentOS Web Panel (XLab, Chinese) blog.xlab.qianxin.com · Research · 2026-11-05
• Ebury is alive but unseen (ESET) web-assets.esetstatic.com · Research
• Control Web Panel changelog control-webpanel.com · Vendor report
• Control Web Panel official site control-webpanel.com · Vendor report
• Hackers backdoor Linux servers using trojanized CWP web server BleepingComputer · News · 2026-11-05

More in malware

• laZzzy Donut: Multi-Stage Loader Chain (Kramer-obfuscated Python, Donut shellcode, laZzzy loader)
• BTMob Android RAT: February 2026 Source Code Leak Expands Access and Resale
• Malicious Browser Extensions Ecosystem: Needle and Lunex Malware, Clean-Then-Update Extension Campaigns
• HEAVYGRAM: Telegram-based Surveillance Backdoor Linked to Handala Hack (Void Manticore / MOIS)
• Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps