# CWPdoor Backdoor Compromises Linux Hosting Servers via Trojanized Web Server Binaries Attackers are replacing legitimate CWP web server binaries with malicious versions to execute hidden commands. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-06 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/aa535d6c-fed9-4f84-9229-c32695008bb0 ## Stealthy Linux Server Backdoor Researchers identified a malicious backdoor named cwpdoor targeting Control Web Panel servers. The threat involves replacing the legitimate cwpsrv web server binary with a trojanized version. This backdoor remains dormant until activated by specific HTTP requests, allowing attackers to execute arbitrary commands while bypassing standard server access logs entirely. ## Root Access Requirement Installing the malicious binary requires root-level privileges on the target machine. While the exact method attackers use to gain this initial access remains unknown, the installer mimics a routine software update. Once deployed, it effectively grants unauthorized actors control over websites, databases, and email services hosted on the server. ## Sophisticated Evasion Tactics The malware employs advanced techniques to remain undetected by administrators. It restores original file timestamps to deceive standard tools like ls and stat, while suppressing logs of malicious activity. Furthermore, the backdoor uses custom headers starting with X-Ngx-Integrity to verify incoming commands, ensuring only authorized attackers can trigger the execution. ## Evidence of Active Exploitation Evidence of real-world infections emerged after an archive containing the backdoor was uploaded to VirusTotal from Brazil on September 30. Although the total number of compromised servers is currently unspecified, researchers noted that over 340,000 CWP instances are exposed to the internet, presenting a significant potential attack surface for exploitation. ## Co-occurrence With Ebury Malware The archive discovered in Brazil also contained Ebury, a long-standing OpenSSH backdoor and credential stealer active since 2009. Researchers have not confirmed a direct link between cwpdoor and Ebury. It remains possible that different threat actors are deploying these distinct malicious tools on the same compromised infrastructure independently of each other. ## Detection and Forensic Challenges Detecting cwpdoor is difficult because the malicious binary initially showed zero detections on VirusTotal. Standard socket checks may also fail to reveal the backdoor, as the system appears normal. Administrators must specifically inspect the cwpsrv processes, search for the ngx_http_integrity_helper socket, and scan binaries for the X-Ngx-Integrity string. ## Required Remediation Procedures Confirmed compromises necessitate immediate action to secure the environment. Administrators should replace the malicious binary with a legitimate version and perform a full software update. Additionally, it is critical to rotate all server credentials and conduct a thorough investigation to identify and remove any other potential malware present on the system. ## Broader Security Implications The emergence of cwpdoor highlights the risks associated with hosting control panels, which serve as central management points for infrastructure. Because these panels handle sensitive data and administrative functions, they are high-value targets. Organizations must prioritize monitoring for unauthorized binary modifications and maintain strict identity visibility to mitigate such persistent threats. ## Sources covering this story - [The Hacker News — Hackers Hide Linux Backdoor in Control Web Panel Server](https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html) - [cybersecurity — Hackers Backdoor Linux Servers Using Trojanized CWP Web Server](https://www.reddit.com/r/cybersecurity/comments/1xoo0nf/hackers_backdoor_linux_servers_using_trojanized/) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._