Hackers backdoor Linux servers using trojanized CWP web server
CWPdoor malware backdoors Linux servers via trojanized CWP web server binary.
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server component of Control Web Panel (CWP), a hosting administration solution. The passive backdoor remains dormant until activated by specially crafted HTTP requests with encrypted commands, and suppresses logging to evade detection. Over 340,000 CWP instances have been exposed publicly, and CWPdoor was discovered bundled with the Ebury backdoor in VirusTotal, indicating active real-world victims.
AI summary of the linked source. Not reviewed by an editor. How this works
Run QiAnXin Technology Group?
Get an email when a new story names QiAnXin Technology Group, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers distributed a malicious, trojanized version of the CWP web server component (cwpsrv), effectively poisoning a trusted hosting administration tool to implant a persistent backdoor called CWPdoor. The malware deliberately suppresses logging to evade detection, meaning defenders relying on standard log analysis would have no visibility into the compromise. Its passive design — remaining dormant until triggered by specially crafted HTTP requests — makes it exceptionally difficult to identify through conventional monitoring. The bundling with the Ebury backdoor further indicates a sophisticated, multi-stage campaign targeting Linux server infrastructure at scale. This incident underscores how trojanized software and log suppression can silently undermine an organization's entire server estate.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CWPdoor
- malware — Ebury
- mitre_attack — T1547.014
- mitre_attack — T1070.002
- mitre_attack — T1071.001