Threat video1:00
CWPdoor Control Web Panel Backdoor: Detection & IOCs
CWPdoor hides in trojanized cwpsrv builds and takes commands via HTTP headers. Its 17 IOCs and 9 detection rules include a free Splunk SPL rule.
Read the full threat intel for CWPdoor Control Web Panel Backdoor: Detection & IOCs →
Chapters
- 0:00The hookCWPdoor backdoors 340,000+ Linux servers.
- 0:05The storyTrojanized cwpsrv update.
- 0:12Attack pathTrojanized installer runs as root.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise14 indicators to hunt: 1 IP, 6 URLs and 3 MD5 hashes, and more.
- 0:38MITRE ATT&CK techniques14 ATT&CK techniques, from initial access to command and control.
- 0:44Remediation5 steps now: Check for the ngx_http_integrity_helper Unix socket.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00CWPdoor backdoors 340,000+ Linux servers.
0:05Trojanized cwpsrv update.
0:08Executes signed commands, wipes traces, stays hidden.
0:13Trojanized installer runs as root.
0:15Cleanup erases installation traces.
0:18Operator sends RSA-signed commands.
0:20Hidden helper executes them silently.
0:23Operator receives encrypted results.
0:27No threat actor is attributed. Confidence: low.
0:3214 indicators to hunt: 1 IP, 6 URLs and 3 MD5 hashes, and more.
0:3914 ATT&CK techniques, from initial access to command and control.
0:445 steps now: Check for the ngx_http_integrity_helper Unix socket.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.