Researchers at QiAnXin's XLab revealed a backdoor lurking within the web server that hosts Control Web Panel (CWP), a free panel used for managing Linux hosting servers. The backdoored web server accepts commands sent via web requests, which never appear in its access logs. The researchers, who dubbed the backdoor cwpdoor, intercepted its installer, a deceptive shell script masquerading as a version update, on June 29.
It mimics the normal program until a request arrives with a valid timestamp and signature in custom headers starting with X-Ngx-Integrity. The installer reinstalls the cwpsrv file, restoring its original dates, but this doesn't affect the verification results.
The researchers published these indicators: MD5: e505d4ffa21cf494a5dc2d7c8f4f1236 (installer script, cwpsrv_update.sh) MD5: 965aea67fb40de1bab5169ada993349f (backdoored cwpsrv 1.15.10) MD5: d3f4e95113d49ab3991b45e457bda75b (backdoored cwpsrv 1.24.0) IP: 136.0.141[. ]71 (download server) URL: https://136.0.141[. ]71/static/cwpsrv_update.sh URL: https://136.0.141[.
]71/static/cwpsrv_1.15.10 URL: https://136.0.141[. ]71/static/cwpsrv_1.24.0 ### Cleaning Up an Infected Server If a server is infected, the researchers recommend three steps: The archive from Brazil contained the Ebury malware, an OpenSSH backdoor, and a credential stealer that has been active since 2009.
