# Hackers Backdoor Linux Servers Using Trojanized CWP Web Server Attackers exploit CWP web server binaries to gain stealthy remote access to infrastructure. - **Source:** [cybersecurity](https://brifing.si/source/57fea5eb-f11e-4b81-bc15-114313a8bd59) - **Published:** 2026-11-05 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/3420a7fe-7acb-44fa-b382-3dfce19abfcc ## Malicious Binary Replacement Attackers are actively targeting Linux servers by distributing a malicious updater. This update replaces the legitimate cwpsrv web-server binary with a trojanized version. Once installed, the backdoor remains dormant on the system, waiting for specific instructions from the attackers to initiate unauthorized activities within the compromised hosting control panel environment. ## Stealthy Command Execution The backdoor is activated through specially crafted HTTP requests containing encrypted commands. To maintain persistence while avoiding detection, the malware suppresses logging of these malicious requests. It also restores original file timestamps and deletes installation evidence, effectively hiding its presence from system administrators who might otherwise notice unusual changes in server logs. ## Encryption and Evasion Communication between the attacker and the compromised server is encrypted, which complicates traditional network monitoring and detection efforts. By masking the command-and-control traffic, the threat actors ensure that security tools struggle to identify the malicious activity. This sophisticated approach makes the backdoor particularly dangerous for organizations relying on standard security protocols. ## Scope of Exposure Researchers have identified evidence of real-world infections, though the exact number of compromised servers remains currently unknown. While more than 340,000 CWP instances are exposed to the internet, this figure represents the total potential attack surface rather than confirmed infections. The high number of exposed instances highlights a significant risk for administrators. ## Impact on Infrastructure Compromised hosting control panels grant attackers deep access to critical infrastructure. This includes websites, sensitive databases, and email services hosted on the server. Beyond these primary targets, attackers may potentially pivot to other connected systems, escalating the breach and putting the entire hosted environment at risk of data theft or manipulation. ## Detection and Indicators Administrators should proactively check for suspicious cwpsrv processes running on their Linux servers. Key indicators of compromise include the presence of the ngx_http_integrity_helper socket and the discovery of X-Ngx-Integrity strings within the server binary. These specific artifacts serve as primary evidence that the system has been tampered with by the attackers. ## Remediation and Recovery Confirmed compromises require immediate action to secure the environment. Administrators must replace the malicious binary with a legitimate version and perform a full software update. Furthermore, it is critical to rotate all credentials and conduct a thorough investigation to ensure no additional malware or secondary backdoors remain hidden within the system. ## Broader Security Implications This attack highlights the vulnerability of web server management tools when they are exposed to the public internet. As attackers refine their methods to bypass logging and timestamp verification, the importance of regular integrity checks increases. Organizations must prioritize hardening their control panels to prevent such sophisticated, stealthy unauthorized access attempts. ## Sources covering this story - https://www.reddit.com/r/cybersecurity/comments/1xoo0nf/hackers_backdoor_linux_servers_using_trojanized/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._