# CWPdoor: Trojanized Control Web Panel cwpsrv binary backdoors Linux servers

> CWPdoor is a passive backdoor embedded in trojanized builds of the Control Web Panel (CWP) cwpsrv web server (1.15.10 and 1.24.0), delivered by a root-run script masquerading as a cwpsrv update. It executes RSA-signed, AES-256-CBC-encrypted commands received via HTTP headers, suppresses access logging, and wipes traces. XLab reports 340,000+ CWP instances exposed on the public web.

- **Published:** 2026-11-05T16:35:28Z
- **Last reviewed:** 2026-11-05T16:35:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5330
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5330.png
- **ID:** TL-2026-5330
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

XLab (QiAnXin) documented CWPdoor, a parasitic backdoor living inside the cwpsrv binary of Control Web Panel (formerly CentOS Web Panel), an nginx-based Linux hosting control panel. The malicious script cwpsrv_update.sh, captured on 2026-06-29, masquerades as a legitimate cwpsrv version update. It requires root, backs up the original binary, replaces /usr/local/cwpsrv/bin/cwpsrv with a trojanized build downloaded from 136.0.141.71 (variants cwpsrv_1.15.10 and cwpsrv_1.24.0), restores the new binary's atime/mtime and its parent directory's timestamp, deletes temporary files and runs history -d to erase command history.

The trojanized cwpsrv behaves as the legitimate service until it receives an HTTP/HTTPS request carrying three headers: X-Ngx-Integrity-Time (timestamp, validated within a +/-300 second window), X-Ngx-Integrity-Data (Base64 AES-256-CBC ciphertext holding the command, IV in the first 16 bytes) and X-Ngx-Integrity-Sig (Base64 RSA signature over '<timestamp>:<ciphertext>'). A 2048-bit RSA public key is embedded in the binary XOR-encrypted with 0x55; the AES key is derived from the SHA-256 digest of the RSA public key string. Because commands must be signed with the operator's private key, the backdoor cannot be triggered by third parties, and signature binding of timestamp plus ciphertext provides replay protection.

The master process hooks the request path at the ngx_http_process_request entry point. Valid commands are handed to a helper child process over a Unix domain socket named ngx_http_integrity_helper, which executes them and returns the encrypted output as an HTTP 200 response with Content-Type application/octet-stream. To remain invisible, the backdoor copies and tampers with the request's module context array, replacing the context pointer of the logging module so triggering requests never reach access logs. The sample was uploaded to VirusTotal from Brazil on 2026-09-30 (as evidencia.tgz / cwpsrv.suspeito) with zero detections.

The archive also contained the Ebury backdoor; the relationship between CWPdoor and Ebury is unclear and XLab suggests it may reflect separate actors compromising the same systems. Ebury operators previously abused CWP in November 2020 to deploy Ebury. No CVE or CVSS has been assigned; severity is analyst-assigned. The initial infection vector used to run the update script on victim hosts is not described in the available sources. Defenders should check for the ngx_http_integrity_helper socket, X-Ngx-Integrity strings in the cwpsrv binary and unexpected helper processes, replace the binary with a legitimate one, upgrade CWP, rotate panel credentials and hunt for additional malware (including Ebury).

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.004 Unix Shell
- T1554 Compromise Host Software Binary
- T1036 Masquerading
- T1070.006 Timestomp
- T1070.003 Clear Command History
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1205 Traffic Signaling
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CWPdoor — Fake cwpsrv Update Script Execution and cwpsrv Binary Replacement** (`TL-2026-5330-SPL-001`)

Detects the CWPdoor installation chain on Linux Control Web Panel hosts: execution of the masquerading cwpsrv_update.sh script, any command line touching the CWPdoor staging server 136.0.141.71, and cp/mv/install/curl/wget writing to /usr/local/cwpsrv/bin/cwpsrv (the trojanized cwpsrv_1.15.10 / cwpsrv_1.24.0 builds). Behaviour-first: fires on the replacement of the panel web server binary, not on a single hash.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1554, T1105, T1036, T1059.004
- **Data sources:** sysmon_for_linux, index=linux sourcetype=sysmon:linux EventID=1
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventID=1 earliest=-24h | eval cmd=coalesce(CommandLine,""), img=coalesce(Image,"") | where like(cmd,"%cwpsrv_update.sh%") OR like(cmd,"%136.0.141.71%") OR (match(img,"/(cp|mv|install|curl|wget)$") AND like(cmd,"%/usr/local/cwpsrv/bin/cwpsrv%")) | stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands values(ParentImage) as parent_images by host, User | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ('cwpsrv_update.sh', '136.0.141.71')
    or (FileName in~ ('cp', 'mv', 'install', 'curl', 'wget') and ProcessCommandLine has '/usr/local/cwpsrv/bin/cwpsrv')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: CWPdoor Fake cwpsrv Update Script or Binary Replacement
id: 7c1d3a52-4b8e-4f0a-9d21-6e5a0b3c8f11
status: experimental
description: Detects execution of the cwpsrv_update.sh installer, references to the CWPdoor staging server 136.0.141.71, or tools overwriting /usr/local/cwpsrv/bin/cwpsrv.
references:
  - https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/
  - https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.persistence
  - attack.t1554
  - attack.command-and-control
  - attack.t1105
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: linux
detection:
  selection_script:
    CommandLine|contains: 'cwpsrv_update.sh'
  selection_ip:
    CommandLine|contains: '136.0.141.71'
  selection_replace:
    Image|endswith:
      - '/cp'
      - '/mv'
      - '/install'
      - '/curl'
      - '/wget'
    CommandLine|contains: '/usr/local/cwpsrv/bin/cwpsrv'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrator manually upgrading or restoring cwpsrv from the vendor
level: high
```

**Known false positives:**

- Administrator manually upgrading or restoring the cwpsrv binary from the official CWP vendor
- Configuration-management or backup jobs that copy files under /usr/local/cwpsrv/bin

**Tuning notes:** Adjust index/sourcetype to your Sysmon-for-Linux or auditd execve ingestion. Allow-list the official CWP updater parent process and known change-window admin accounts; keep the 136.0.141.71 and cwpsrv_update.sh clauses unfiltered since they are near-zero-FP.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CWPdoor — Trojanized cwpsrv Binary and Installer File Writes (Defender for Endpoint) (locked: unlock with TL Creds)
- CWPdoor — cwpsrv Spawning Shells or Helper Executing Commands (Defender for Endpoint) (locked: unlock with TL Creds)
- CWPdoor — Connections to Staging Server [indicator] or cwpsrv Public Outbound (Defender for Endpoint) (locked: unlock with TL Creds)
- CWPdoor — curl/wget Download of [indicator] or Trojanized cwpsrv from [indicator] (locked: unlock with TL Creds)
- CWPdoor — Trojanized cwpsrv Process Started with Known MD5 Hash (locked: unlock with TL Creds)
- CWPdoor — Successful Backdoor Command Exchange (All Three Headers plus octet-stream Response) (locked: unlock with TL Creds)
- CWPdoor — Post-Install Anti-Forensics (Timestomp, Installer Cleanup, History Wipe) (locked: unlock with TL Creds)
- CWPdoor — X-Ngx-Integrity Trigger Headers in HTTP Traffic (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `136.0.141[.]71`
- File hash: `e505d4ffa21cf494a5dc2d7c8f4f1236`
- File hash: `965aea67fb40de1bab5169ada993349f`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers backdoor Linux servers using trojanized CWP web server](https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/)
- [CWPdoor: The Invisible Backdoor Living Inside Control Web Panel (XLab)](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/)
- [Beware of CWPdoor: zero-detection passive backdoor in CentOS Web Panel (XLab, Chinese)](https://blog.xlab.qianxin.com/beware-of-cwpdoor-the-zero-detection-pas-backdoor-hiding-in-centos-websive-panel/)
- [Ebury is alive but unseen (ESET)](https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf)
- [Control Web Panel changelog](https://control-webpanel.com/changelog)
- [Control Web Panel official site](https://control-webpanel.com/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5330