Hackers Backdoor Linux Servers via Trojanized CWP Server

What happened: a fake updater swaps in a backdoored web server

A new Linux malware called CWPdoor is spread through a trojanized cwpsrv. That is the web server behind the Control Web Panel (CWP) management interface. BleepingComputer reported it on November 5, 2026, based on research from XLab, the research arm of QiAnXin Technology Group.

XLab found the malware on June 29. It captured a script posing as an updater that replaced the real cwpsrv binary with a malicious one.

CWP, formerly CentOS Web Panel, is an open-source hosting admin tool. It is similar to cPanel and Plesk. Admins use it to manage email, DNS and databases.

Who is affected

Any Linux server running CWP where the cwpsrv binary was replaced. The fake updater targets two versions:

Exposure is not the same as infection. The 340,000 figure counts CWP instances reachable on the public web. It does not count compromised hosts.

How serious it is and whether it is exploited

Treat it as serious. XLab calls CWPdoor "exceptionally stealthy" because it is passive and suppresses logs.

It also appears to be used already. A malicious cwpsrv file was uploaded to VirusTotal on September 30 inside an archive that also held the Ebury backdoor. It had zero detections. XLab says this shows "real victims already exist in the wild."

Here is how the backdoor works:

• It sits dormant until the attacker sends a specially crafted request.

• The command travels in an encrypted HTTP header, X-Ngx-Integrity-Data.

• Two more headers carry a timestamp (X-Ngx-Integrity-Time) and an RSA signature (X-Ngx-Integrity-Sig).

• The backdoor accepts the request only if the timestamp is within a five-minute window and the signature checks out.

• Commands and output are encrypted with AES-256-CBC.

• It interferes with the server's logging module, so the triggering request does not show in access logs.

The installer script also restores file and directory timestamps, deletes temporary files and wipes the command-history log. So file dates, access logs and shell history will not clear a server. Check the binary and the system itself.

The link between Ebury and CWPdoor is not confirmed yet. Follow the BleepingComputer report for updates from XLab.

Check your servers now

XLab recommends three checks. Run them as root on every host that runs CWP.

First, find the cwpsrv binary:

find / -type f -name cwpsrv 2>/dev/null

Next, look for the helper Unix socket named ngx_http_integrity_helper:

ss -xl | grep ngx_http_integrity_helper
find / -name '*ngx_http_integrity_helper*' 2>/dev/null

Then list cwpsrv processes and look for suspicious helpers:

ps -eo pid,ppid,user,lstart,cmd | grep '[c]wpsrv'

Finally, search the binary for the backdoor's header strings. Replace the path with the one find returned:

strings -a /path/to/cwpsrv | grep -i 'X-Ngx-Integrity'

A quick worked example

Say find returns one path and ss -xl prints nothing. But strings shows X-Ngx-Integrity-Data in the binary. Treat that host as compromised. The socket may simply not be active right now, and the strings are what the researchers told admins to look for.

A clean result on all three checks is good news. It is not proof, because the malware hides its tracks. If the host is exposed to the internet, also confirm you downloaded your CWP binary from a source you trust.

If you find a match

Follow XLab's guidance, in this order:

1. Replace the backdoored binary with a legitimate copy.

2. Upgrade CWP to the latest version.

3. Rotate all control panel credentials.

4. Investigate the host for additional malware.

Step 4 matters because of the Ebury archive. Ebury is a Linux backdoor and credential-stealing botnet active since at least 2009. A May 2024 ESET report said it had infected nearly 400,000 servers since it emerged. If your investigation turns up Ebury, assume stolen credentials and rotate beyond the panel, such as SSH keys and database passwords.

While you work, limit who can reach the panel. A firewall rule that allows only your admin IP ranges cuts the number of hosts that can send the trigger request. It does not remove a backdoor that is already installed.

What IT and security learners can take from this

This attack skips the vulnerability and goes after the update path. The attacker replaced a trusted binary, then hid it with restored timestamps and wiped history. Good Linux admins verify binaries, watch for unexpected sockets and processes, and keep logs somewhere an attacker on the host cannot edit.

Those habits are core Linux administration skills. If you want a structured way to practice them, the XK0-005 exam guide covers CompTIA Linux+ prep. Our Linux and server administration certifications page lists related paths. When you are ready to sit the exam, the CompTIA Linux+ XK0-005 voucher is delivered by email within 12 hours.

Sources

• Hackers backdoor Linux servers using trojanized CWP web server (BleepingComputer)