{"id":4090,"date":"2026-11-08T09:47:45","date_gmt":"2026-11-08T17:47:45","guid":{"rendered":"https:\/\/cyber.mag212.com\/cwpdoor-control-web-panel-backdoor-hides-from-logs\/"},"modified":"2026-11-08T09:47:45","modified_gmt":"2026-11-08T17:47:45","slug":"cwpdoor-control-web-panel-backdoor-hides-from-logs","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/cwpdoor-control-web-panel-backdoor-hides-from-logs\/","title":{"rendered":"cwpdoor: Trojanized Control Web Panel Server Runs Root Commands Without Leaving Logs"},"content":{"rendered":"\n

QiAnXin XLab has published an analysis of cwpdoor<\/strong>, a backdoor built into a recompiled copy of cwpsrv<\/code>, the web server behind Control Web Panel (CWP). The modified server keeps serving the hosting panel as normal. When it receives a request carrying signed X-Ngx-Integrity<\/code> headers, it runs the attacker’s command and leaves no access-log entry, and its installer puts the original file timestamps back afterwards. When XLab checked, the implant had zero detections on VirusTotal. A sample uploaded from Brazil was packaged together with the Ebury SSH backdoor, so CWP operators should look for both.<\/p>\n\n\n\n

What<\/strong><\/td>cwpdoor: a trojanized, recompiled cwpsrv<\/code> binary that gives remote command execution<\/td><\/tr>
Researchers<\/strong><\/td>QiAnXin XLab (Alex.Turing, Acey9), published 5 Nov 2026; reported by The Hacker News on 6 Nov 2026<\/td><\/tr>
Affected<\/strong><\/td>CWP hosts running cwpsrv 1.15.10<\/strong> or 1.24.0<\/strong> (the only versions the installer supports)<\/td><\/tr>
Prerequisite<\/strong><\/td>Root on the server. The initial access vector is unknown, and no CVE is linked<\/td><\/tr>
Detection<\/strong><\/td>0\/63 engines on VirusTotal for the backdoored binary at the time of XLab’s analysis<\/td><\/tr>
In the wild<\/strong><\/td>Yes, according to XLab: the installer was captured on 29 Jun 2026 and a sample was uploaded from Brazil on 30 Sep. The number of victims is unknown<\/td><\/tr>
Action<\/strong><\/td>Hunt on every CWP host, check for Ebury at the same time, rotate credentials, and rebuild where possible<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

On 29 June 2026, XLab’s threat-intelligence system captured a script called cwpsrv_update.sh<\/code>. The script downloads a replacement cwpsrv<\/code> from 136.0.141[.]71 and installs it in place of the legitimate binary. XLab stresses that cwpdoor is not a separate implant. In its words, “the attacker inserts malicious code into the cwpsrv source code and recompiles it.”<\/a> The function names XLab recovered, such as ngx_http_process_request<\/code>, show that cwpsrv is derived from nginx. That means the backdoor runs inside a process that defenders expect to be listening on the network.<\/p>\n\n\n\n

On 30 September, someone uploaded an archive named evidencia.tgz<\/code> (“evidence”) to VirusTotal from Brazil. It held two files: cwpsrv.suspeito<\/code>, which is cwpdoor with zero detections, and libkeyutils.so.1.5.2<\/code>, which most engines flagged as Ebury<\/strong>. Ebury is an OpenSSH backdoor and credential stealer that has been active since 2009. XLab says it is unclear whether the two implants are related, and that two different actors may have compromised the same server. XLab also counted more than 340,000 internet-exposed CWP instances in the past month. That figure measures how many servers could be targeted, not how many are infected.<\/p>\n\n\n\n

\"Diagram
Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

How the attack works<\/h2>\n\n\n\n

Installer.<\/strong> The script runs as root and presents itself as a version update. It works as follows:<\/p>\n\n\n\n