# Linux cwpdoor Backdoor in Control Web Panel: Detection & Mitigation

> Uncover the cwpdoor Linux backdoor targeting Control Web Panel (CWP) servers, enabling stealthy command execution without logs. Learn detection and mitigation.

- Published: 2026-11-08T20:03:03.000Z
- Severity: high
- Category: Malware
- Tags: Linux, Backdoor, Cwpdoor, Control Web Panel, CWP
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
- Canonical: https://runtimerebel.com/blog/linux-cwpdoor-backdoor-in-control-web-panel-detection-mitigation

## Key points

- Immediate impact: cwpdoor Linux backdoor enables stealthy command execution without logging on compromised CWP servers.
- Affected systems: Control Web Panel (CWP) servers running cwpsrv versions 1.15.10 and 1.24.0.
- Remediation: Check for malicious processes via backdoor socket 127.0.0.1:52923 and verify cwpsrv binary integrity.

## Linux cwpdoor [Backdoor](/glossary#backdoor) Discovered in Control Web Panel Servers

Security researchers at QiAnXin's XLab have uncovered a stealthy Linux backdoor, dubbed "cwpdoor," embedded within the `cwpsrv` web server component of Control Web Panel (CWP). CWP is a popular, free management panel for Linux hosting servers. This sophisticated backdoor allows attackers to execute commands remotely without leaving traces in standard access logs, posing a significant risk to affected environments. Evidence suggests that [real victims already exist in the wild](https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html), with an archive containing the backdoor uploaded to VirusTotal from Brazil on September 30.

The presence of `cwpdoor` undermines the integrity of server management, enabling persistent access and covert operations. Given that its installation requires root access, attackers must have already achieved initial compromise of the target server. However, once installed, the backdoor provides a persistent and highly discreet channel for further malicious activities, making detection challenging for system administrators.

### Technical Analysis of the cwpdoor Backdoor

The `cwpdoor` backdoor is not a separate malicious file but rather a recompiled version of the legitimate `cwpsrv` web server binary itself, which has been modified to include additional malicious code. It mimics the normal behavior of the `cwpsrv` program until it receives a web request containing specific, valid timestamps and signatures within custom HTTP headers that begin with `X-Ngx-Integrity`. Upon validation of these headers, the backdoor executes the command embedded within the request, bypassing normal logging mechanisms. This mechanism allows for remote code execution ([RCE](/glossary#rce)) without generating any entries in the `access.log` or `error.log` files, severely hindering forensic analysis.

The installer for `cwpdoor` is a shell script masquerading as a version update, specifically targeting `cwpsrv` versions `1.15.10` and `1.24.0`. To evade detection, the installer cleverly manipulates file metadata; after replacing the legitimate `cwpsrv` binary with the backdoored version, it restores the original file creation and modification dates. This tactic makes it difficult to spot changes using common file integrity checks like `ls` or `stat`, which would show the file as untouched. At the time of the researchers' check, the backdoored file showed zero detections out of 63 on VirusTotal, highlighting its evasive nature.

The archive uploaded from Brazil also contained the Ebury [malware](/glossary#malware), an OpenSSH backdoor and credential stealer known to be active since at least 2009. While `Ebury` was found alongside `cwpdoor`, researchers have not yet confirmed a direct relationship between the two, indicating that different threat actors might be operating on the same compromised servers. Understanding the operational overlap between `cwpdoor` and other persistent threats like `Ebury` is crucial for developing comprehensive defense strategies.

### Detecting cwpdoor Linux Backdoor and Mitigation Strategies

**How to detect cwpdoor Linux backdoor [exploit](/glossary#exploit)** and its presence is paramount for server security. Defenders should prioritize proactive measures to identify and eliminate this threat. QiAnXin's XLab provided several indicators of compromise (IoCs) and recommended steps for detection and remediation:

**Indicators of Compromise (IoCs):**
*   **MD5 Hash:** `c6177114b7e7a83d470659630c149d5a`
*   **ELF SHA256 Hash:** `41655f419c991e0a297ee4580f8489aa84102c019d3fb4d2f00a40098f98c8c2` (for the backdoored `cwpsrv` binary)
*   **Installer SHA256 Hash:** `2a3b01859737f40cf2ae23ff826b8969f69796e6804fb05a30648c668b577005` (for the shell script installer)

**Recommended Remediation Steps:**
1.  **Check for malicious processes:** Investigate for any unusual processes communicating via the backdoor's internal socket, specifically `127.0.0.1:52923`. This might require advanced network monitoring or `netstat` commands to identify suspicious connections.
2.  **Verify log file integrity:** Although the backdoor doesn't log its activities, check the integrity of `/usr/local/cwpsrv/logs/access.log` and `/usr/local/cwpsrv/logs/error.log` for any signs of tampering or unexpected modifications. Anomalies could indicate other forms of compromise.
3.  **Validate `cwpsrv` binary integrity:** Perform a checksum verification of the `cwpsrv` binary located at `/usr/local/cwpsrv/bin/cwpsrv` against known good versions. Using the provided SHA256 hash (`41655f419c991e0a297ee4580f8489aa84102c019d3fb4d2f00a40098f98c8c2`) can help identify a compromised binary. If compromised, replace it with a clean, officially downloaded version.

Beyond these immediate steps, organizations managing Control Web Panel servers should:
*   Implement strict access controls, especially for root privileges.
*   Regularly audit server logs for unusual activity, even if direct `cwpdoor` actions are hidden.
*   Deploy [endpoint](/glossary#endpoint) detection and response ([EDR](/glossary#edr)) solutions capable of behavioral analysis to detect anomalous process execution or network communication patterns.
*   Ensure all software, including Control Web Panel and its components, is kept up-to-date with the latest security patches to prevent initial root compromise.
*   Monitor for the presence of other malware like `Ebury` as a secondary compromise indicator.

**Related:** [New Linux Backdoors Mimic Asian Mail Security Products](/blog/new-linux-backdoors-mimic-asian-mail-security-products), [Linux Backdoors Target Telecom Networks with Regional Spoofing](/blog/linux-backdoors-target-telecom-networks-with-regional-spoofing)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/linux-cwpdoor-backdoor-in-control-web-panel-detection-mitigation