{"id":"CMP-202611-2hvaws","kind":"campaign","aliases":[],"related":[],"title":"Backdoored Control Web Panel server (cwpdoor): attackers swap the CWP panel binary cwpsrv for a copy that runs their commands and hides them from logs (XLab)","description":null,"summary":"Attackers with root on Control Web Panel (CWP, formerly CentOS Web Panel) servers run a fake 'update' script (cwpsrv_update.sh) that replaces /usr/local/cwpsrv/bin/cwpsrv with a recompiled backdoored build (cwpdoor) for cwpsrv 1.15.10 and 1.24.0. The backdoor wakes only on an RSA-signed HTTP request carrying X-Ngx-Integrity-* headers, runs the encrypted command, and drops the request from access logs; the script also resets file timestamps and wipes shell history. XLab first saw the script on 29 Jun 2026; a victim sample was uploaded to VirusTotal from Brazil on 30 Sep 2026 alongside the Ebury backdoor, so real servers are infected. Antivirus detection was zero. How attackers first get in is unknown (recent CWP flaws CVE-2026-73695 and related are a plausible but unconfirmed route). XLab counts about 340,000 internet-exposed CWP instances.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-05T16:35:04+00:00","products":[{"name":"Control Web Panel","fixed":[],"affected":"cwpsrv 1.15.10, 1.24.0 (binary replaced)","ecosystem":"linux"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- On CWP servers run: ss -axp | grep integrity  (a Unix socket named ngx_http_integrity_helper means infected)\n- strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity  (any match means infected)\n- ps aux | grep cwpsrv for unexpected helper child processes\n- Files named cwpsrv.prev-YYYYMMDD-HHMMSS in /usr/local/cwpsrv/bin (the attacker's backup of the real binary)\n- MD5: e505d4ffa21cf494a5dc2d7c8f4f1236 (cwpsrv_update.sh), 965aea67fb40de1bab5169ada993349f (cwpsrv_1.15.10), d3f4e95113d49ab3991b45e457bda75b (cwpsrv_1.24.0)\n- Network/proxy logs for 136.0.141[.]71, including http://136.0.141[.]71/static/cwpsrv_update.sh, /static/cwpsrv_1.15.10, /static/cwpsrv_1.24.0\n- File timestamps are reset by the script, so do not rely on ls/stat dates","fix":"- If infected: restore the real binary from the cwpsrv.prev-* backup, upgrade CWP to the latest release, and confirm ss -axp | grep integrity returns nothing\n- Rotate all control panel, root and SSH credentials; treat the host as fully compromised and look for other implants (Ebury was found next to cwpdoor)\n- Block 136.0.141.71\n- Upgrade all CWP servers to the latest release (fixes the 2026 CWP RCE chain) and restrict panel ports to trusted IPs","status":"open","published_at":null,"first_seen_at":"2026-11-05T16:35:04+00:00","triaged_at":"2026-11-05T16:35:04+00:00","updated_at":"2026-11-05T16:35:39+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2':29A '-2026':156B '-202611':28A '-73695':157B '/usr/local/cwpsrv/bin/cwpsrv':60B '000':170B '1.15.10':69B '1.24.0':71B '2026':118B,131B '29':116B '30':129B '340':169B 'access':98B 'alongsid':132B 'also':102B 'antivirus':141B 'attack':7A,39B,146B 'backdoor':1A,64B,73B,135B 'binari':12A 'brazil':127B 'build':65B 'campaign':35B 'carri':83B 'cento':48B 'cmp':27A 'command':20A,92B 'control':2A,32A,43B 'copi':16A 'count':167B 'cve':155B 'cwp':10A,46B,153B,174B 'cwpdoor':6A,31A,66B 'cwpsrv':13A,68B 'cwpsrv_update.sh':57B 'detect':142B 'drop':94B 'earli':37B 'early-warn':36B 'eburi':134B 'encrypt':91B 'expos':173B 'fake':54B 'file':104B 'first':111B,147B 'flaw':154B 'former':47B 'get':148B 'header':88B 'hide':22A 'histori':109B 'http':81B 'hvaws':30A 'infect':140B 'instanc':175B 'integr':87B 'internet':172B 'internet-expos':171B 'jun':117B 'log':25A,99B 'ngx':86B 'panel':4A,11A,34A,45B,50B 'plausibl':162B 'real':137B 'recent':152B 'recompil':63B 'relat':159B 'replac':59B 'request':82B,96B 'reset':103B 'root':41B 'rout':165B 'rsa':79B 'rsa-sign':78B 'run':18A,52B,89B 'sampl':121B 'saw':112B 'script':56B,101B,114B 'sep':130B 'server':5A,51B,138B 'shell':108B 'sign':80B 'swap':8A 'timestamp':105B 'unconfirm':164B 'unknown':151B 'updat':55B 'upload':123B 'victim':120B 'virustot':125B 'wake':74B 'warn':38B 'web':3A,33A,44B,49B 'wipe':107B 'x':85B 'x-ngx-integr':84B 'xlab':26A,110B,166B 'zero':144B","nicknames":["cwpdoor"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["controlwebpanel","cwpdoor","webpanel"],"ptokens":["control","panel","web"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"malware","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-2hvaws","url":"https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T16:35:04+00:00","fetched_at":"2026-11-05T16:35:04+00:00","note":null,"cites":["https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/"]}],"documents":[{"id":77589,"url":"https://x.com/BleepinComputer/status/2118378984064860614","title":"@BleepinComputer: Hackers backdoor Linux servers using trojanized CWP web server\nhttps://t.co/zkhS","kind":"post","source":"x","publisher":null,"text":"Hackers backdoor Linux servers using trojanized CWP web server\nhttps://t.co/zkhSmrlkEm\n\nhttps://t.co/zkhSmrlkEm\n\nlikes 4 reposts 4","published_at":"2026-11-05T16:24:42+00:00","relation":"describes","confidence":null,"note":null},{"id":77595,"url":"https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/","title":"CWPdoor: The Invisible Backdoor Living Inside Control Web Panel (XLab)","kind":"blog","source":"analyst","publisher":null,"text":"XLab (QiAnXin): cwpsrv_update.sh downloaded from 136.0.141.71 replaces /usr/local/cwpsrv/bin/cwpsrv (CWP versions 1.15.10 and 1.24.0) with a recompiled backdoored binary (cwpdoor). Triggered by HTTP headers X-Ngx-Integrity-Time/-Data/-Sig (RSA signed, AES encrypted command), suppresses logging, Unix socket ngx_http_integrity_helper. Script captured 29 Jun 2026; victim sample uploaded to VirusTotal from Brazil 30 Sep 2026 alongside Ebury. Infection vector unknown. IOCs: MD5 e505d4ffa21cf494a5dc2d7c8f4f1236 (script), 965aea67fb40de1bab5169ada993349f (cwpsrv_1.15.10), d3f4e95113d49ab3991b45e457bda75b (cwpsrv_1.24.0); URLs http://136.0.141[.]71/static/cwpsrv_update.sh, /static/cwpsrv_1.15.10, /static/cwpsrv_1.24.0. Check: ss -axp | grep integrity; strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity. Fix: restore cwpsrv.prev-<date> backup, upgrade, rotate panel credentials, treat host as compromised.","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}