Threat actors backdoor Linux servers with trojanized Control Web Panel binary

Key facts

Discovery timeline and 340,000-server attack surface

On Thursday 5 November 2026, cybersecurity threat research team QiAnXin XLab and BleepingComputer revealed the discovery of CWPdoor, a highly covert Linux backdoor embedded directly into the dedicated web server of Control Web Panel (CWP). Formerly known as CentOS Web Panel, CWP is an open-source graphical server management interface used by hosting providers to administer Apache, Nginx, PHP, email, DNS, and database services.

Telemetry from QiAnXin's Hunter platform revealed that over 340,000 CWP servers were directly accessible from the public internet during October 2026. The threat actors initially deployed a staging script named cwpsrv_update.sh, first captured by threat intelligence systems on 29 June 2026. The script fetches precompiled replacement binaries from a remote server (136.0.141.71) targeting cwpsrv versions 1.15.10 and 1.24.0. The installer overwrites /usr/local/cwpsrv/bin/cwpsrv and uses timestamp-cloning utilities (touch -r) so that file metadata appears unaltered.

Zoom

Chronological development and detection timeline of the CWPdoor campaign

Date	Campaign Event	Technical Observation	Analytical Significance
29 June 2026	Delivery Script Capture	cwpsrv_update.sh retrieved from 136.0.141.71	First sensor detection of automated binary replacement
30 September 2026	In-the-Wild Victim Sample	evidencia.tgz uploaded to VirusTotal from Brazil	93 days after initial script capture; zero AV detection (derived)
5 November 2026	Public Vulnerability Report	Full technical analysis published by XLab and BleepingComputer	129 days elapsed across investigation lifecycle (derived)

The campaign reached active in-the-wild exploitation on 30 September 2026, when an incident response archive (evidencia.tgz) was uploaded to VirusTotal from Brazil. The archive contained both an Ebury (Windigo) SSH credential-stealing module and a trojanized cwpsrv binary. While antivirus engines flagged Ebury, the detection rate for the trojanized cwpsrv binary was exactly zero percent.

Passive triggering and cryptographic header verification

CWPdoor avoids detection by operating without persistent outbound socket connections or background polling loops. The trojanized binary embeds malicious execution logic directly into the Nginx source code that powers cwpsrv. During routine web traffic, the server behaves identically to a legitimate management interface, answering administrative requests without anomaly.

Backdoor routines activate only when an inbound HTTP or HTTPS request contains three specific request headers: X-Ngx-Integrity-Time, X-Ngx-Integrity-Sig, and X-Ngx-Integrity-Data. The function ngx_http_integrity_check inspects these headers at the entry point of ngx_http_process_request before standard URL routing occurs.

Triad header cryptographic validation parameters

HTTP Header Field	Cryptographic Scheme	Operational Purpose	Defensive Evasion Impact
X-Ngx-Integrity-Time	Unix Epoch Timestamp	Replay protection window (±300 seconds, derived)	Prevents packet replay attacks across network captures
X-Ngx-Integrity-Sig	RSA-2048 Digital Signature	Verifies authenticity of concatenated Time:Data string	Restricts trigger capability strictly to private key holder
X-Ngx-Integrity-Data	AES-256-CBC Ciphertext	Base64-encoded command string (16-byte IV prefixed)	Obfuscates shell commands inside encrypted ciphertext

The 2048-bit RSA public key embedded in the binary is obfuscated using single-byte XOR key 0x55 (85 decimal, derived). When verification succeeds, the master process derives an AES key from the SHA-256 digest of the RSA public key string, decrypts the command payload, and forwards it across a dedicated local Unix domain socket named ngx_http_integrity_helper to a background helper child process for execution.

In-memory module context manipulation for log evasion

Beyond passive triggering, CWPdoor implements an in-memory defense mechanism that neutralizes forensic auditing. In standard Nginx architectures, every completed HTTP transaction triggers the ngx_http_log_handler function to write client IP addresses, timestamps, request paths, and HTTP status codes into access.log.

Zoom

During server initialization, the function ngx_http_integrity_init scans the global ngx_modules array to locate and cache the specific index assigned to the HTTP logging module. When a legitimate client visits the server, logging proceeds normally. However, when an incoming request matches the backdoor trigger, CWPdoor tampers with that request's internal module context array, replacing the logging module pointer with a NULL or dummy reference.

When Nginx reaches the logging execution phase, it encounters the invalid context pointer and silently bypasses log generation. The command execution result is returned to the attacker as an encrypted binary blob inside an HTTP 200 response with the header Content-Type: application/octet-stream, leaving zero entries in /usr/local/cwpsrv/logs/access.log.

Detection indicators and server triage protocol

Because CWPdoor generates no external network connections, leaves zero access log entries, and mimics legitimate timestamps via touch -r, traditional signature-based monitoring and file timestamp audits are insufficient. System administrators must inspect active operating system state directly.

Zoom

Recommended administrative commands for CWPdoor detection and remediation

Audit Phase	Inspection Command	Expected Clean Output	Compromise Indicator
Socket Audit	ss -axp | grep integrity	Zero results returned	Active socket: ngx_http_integrity_helper
Process Audit	ps aux | grep cwpsrv	Only master and legitimate worker pool	Unparented or anomalous helper child process
Binary Strings	strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity	Zero matches in official release	Strings matching X-Ngx-Integrity headers
Binary Hash	md5sum /usr/local/cwpsrv/bin/cwpsrv	Official vendor package checksum	Matches 965aea67... or d3f4e951...

If an infection is identified, administrators should immediately restore uncompromised binaries from legitimate pre-update backups (such as cwpsrv.prev-*), reinstall Control Web Panel from official vendor repositories, and perform full credential rotation across all Linux root accounts, web panel users, database passwords, and SSH authorized keys.