CWPdoor backdoors Linux servers through trojanized Control Web Panel binaries
A new Linux backdoor called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel management interface, BleepingComputer reported on November 5. Researchers at XLab said the malware remains dormant until an attacker sends a specially crafted request.
Control Web Panel, formerly called CentOS Web Panel, is an open-source hosting administration system for managing services including email, DNS and databases, according to BleepingComputer. XLab said more than 340,000 CWP instances had been exposed on the public web over the previous month.
XLab discovered the malware on June 29 after capturing a script that posed as an updater and replaced the legitimate cwpsrv binary with a malicious version. The script targets cwpsrv versions 1.15.10 and 1.24.0, and attempts to conceal the replacement by restoring timestamps, deleting temporary files and wiping the command-history log, BleepingComputer wrote.
The attacker activates CWPdoor through encrypted HTTP headers. The request carries an encrypted command in X-Ngx-Integrity-Data, a timestamp in X-Ngx-Integrity-Time and an RSA signature in X-Ngx-Integrity-Sig, according to XLab. The backdoor accepts timestamps within a five-minute window, verifies the signature, decrypts the command with AES-256-CBC and passes it to a helper process for execution. XLab also said the malware interferes with the server's logging module so the triggering request does not appear in access logs.
The researchers found CWPdoor in an archive uploaded to VirusTotal on September 30 alongside the Ebury backdoor. BleepingComputer reported that the malicious cwpsrv file in the archive had zero detections. XLab said this showed that the campaign was not merely experimental and that real victims already existed, while the connection between Ebury and CWPdoor remained unclear.
Administrators should check for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes and X-Ngx-Integrity strings in the server binary, XLab recommended. If they confirm a compromise, the researchers advised replacing the backdoored binary with a legitimate copy, upgrading to the latest version, rotating all Control Web Panel credentials and investigating the host for additional malware.