Hackers Backdoor Linux Servers Using Trojanized CWP Web Server
Attackers exploit CWP web server binaries to gain stealthy remote access to infrastructure.
1Malicious Binary Replacement
Attackers are actively targeting Linux servers by distributing a malicious updater. This update replaces the legitimate cwpsrv web-server binary with a trojanized version. Once installed, the backdoor remains dormant on the system, waiting for specific instructions from the attackers to initiate unauthorized activities within the compromised hosting control panel environment.
2Stealthy Command Execution
The backdoor is activated through specially crafted HTTP requests containing encrypted commands. To maintain persistence while avoiding detection, the malware suppresses logging of these malicious requests. It also restores original file timestamps and deletes installation evidence, effectively hiding its presence from system administrators who might otherwise notice unusual changes in server logs.
3Encryption and Evasion
Communication between the attacker and the compromised server is encrypted, which complicates traditional network monitoring and detection efforts. By masking the command-and-control traffic, the threat actors ensure that security tools struggle to identify the malicious activity. This sophisticated approach makes the backdoor particularly dangerous for organizations relying on standard security protocols.
4Scope of Exposure
Researchers have identified evidence of real-world infections, though the exact number of compromised servers remains currently unknown. While more than 340,000 CWP instances are exposed to the internet, this figure represents the total potential attack surface rather than confirmed infections. The high number of exposed instances highlights a significant risk for administrators.
5Impact on Infrastructure
Compromised hosting control panels grant attackers deep access to critical infrastructure. This includes websites, sensitive databases, and email services hosted on the server. Beyond these primary targets, attackers may potentially pivot to other connected systems, escalating the breach and putting the entire hosted environment at risk of data theft or manipulation.
6Detection and Indicators
Administrators should proactively check for suspicious cwpsrv processes running on their Linux servers. Key indicators of compromise include the presence of the ngx_http_integrity_helper socket and the discovery of X-Ngx-Integrity strings within the server binary. These specific artifacts serve as primary evidence that the system has been tampered with by the attackers.
7Remediation and Recovery
Confirmed compromises require immediate action to secure the environment. Administrators must replace the malicious binary with a legitimate version and perform a full software update. Furthermore, it is critical to rotate all credentials and conduct a thorough investigation to ensure no additional malware or secondary backdoors remain hidden within the system.
8Broader Security Implications
This attack highlights the vulnerability of web server management tools when they are exposed to the public internet. As attackers refine their methods to bypass logging and timestamp verification, the importance of regular integrity checks increases. Organizations must prioritize hardening their control panels to prevent such sophisticated, stealthy unauthorized access attempts.
Original article: cybersecurity — Hackers Backdoor Linux Servers Using Trojanized CWP Web Server