XLab found a new Linux backdoor called CWPdoor hidden inside a trojanized cwpsrv, the web server behind Control Web Panel (formerly CentOS Web Panel), BleepingComputer reports.
- A fake updater script swaps in the malicious binary over cwpsrv 1.15.10 and 1.24.0, then restores timestamps and wipes command history
- It’s passive. It wakes up on an encrypted, RSA-signed HTTP header (X-Ngx-Integrity-Data) with a ±5-minute timestamp window, and it suppresses those requests from the access logs
- A sample showed up on VirusTotal with zero detections, bundled with the Ebury backdoor, so there are real victims
- About 340,000 CWP instances were exposed online last month
Check for
An ngx_http_integrity_helper Unix socket, odd cwpsrv helper processes, and X-Ngx-Integrity strings in the binary. If you find them, replace the binary, upgrade, rotate all panel credentials and hunt for more malware.
My take
A swapped binary with clean logs is nasty. My how-to on checking binaries against known-good copies is below.
God Bless, and Needs Garlic!
