[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgK01MyN5AIfc-GbTg4_4bvv5Q61SS4yT7CZPE0-pKyc":3},{"article":4,"iocs":47,"watch_terms":64,"solutions":65,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4136d1d6-aa4d-4c03-b96d-9d82caf067fe","Hackers backdoor Linux servers using trojanized CWP web server","hackers-backdoor-linux-servers-using-trojanized-cwp-web-server-56bfa0","A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]","A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server component of Control Web Panel (CWP), a hosting administration solution. The passive backdoor remains dormant until activated by specially crafted HTTP requests with encrypted commands, and suppresses logging to evade detection. Over 340,000 CWP instances have been exposed publicly, and CWPdoor was discovered bundled with the Ebury backdoor in VirusTotal, indicating active real-world victims.","CWPdoor malware backdoors Linux servers via trojanized CWP web server binary.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-backdoor-linux-servers-using-trojanized-cwp-web-server\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F29\u002FLinux.jpg","2026-11-05T16:24:26+00:00","2026-11-05T17:00:24.150861+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"Control Web Panel (CWP)","product",{"name":21,"type":19},"cwpsrv",{"name":23,"type":24},"QiAnXin Technology Group","vendor",{"name":26,"type":27},"Ebury botnet operators","threat_actor",{"name":29,"type":30},"Linux","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,51,54,58,61],{"type":35,"value":49,"context":50},"CWPdoor","Passive Linux backdoor distributed via trojanized cwpsrv binary",{"type":35,"value":52,"context":53},"Ebury","Linux backdoor and credential stealer botnet, found bundled with CWPdoor in VirusTotal",{"type":55,"value":56,"context":57},"mitre_attack","T1547.014","Persistence via web shell\u002Fbackdoor in web server binary",{"type":55,"value":59,"context":60},"T1070.002","Log suppression and timestamp manipulation for anti-forensics",{"type":55,"value":62,"context":63},"T1071.001","Command and control via encrypted HTTP headers (X-Ngx-Integrity-Data)",[23,18,21],{"controls":66,"vendors":150},[67,96,124],{"slug":68,"name":69,"problem":70,"products":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":97,"name":98,"problem":99,"products":100},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[101,109,116],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":111,"url":114,"description":115},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":125,"name":126,"problem":127,"products":128},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":146,"product_name":147,"url":148,"description":149},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":163},"trojanized-cwp-web-server-delivers-stealthy-linux-backdoor-to-340000-exposed-hosts","Trojanized CWP Web Server Delivers Stealthy Linux Backdoor to 340,000+ Exposed Hosts","Attackers distributed a malicious, trojanized version of the CWP web server component (cwpsrv), effectively poisoning a trusted hosting administration tool to implant a persistent backdoor called CWPdoor. The malware deliberately suppresses logging to evade detection, meaning defenders relying on standard log analysis would have no visibility into the compromise. Its passive design — remaining dormant until triggered by specially crafted HTTP requests — makes it exceptionally difficult to identify through conventional monitoring. The bundling with the Ebury backdoor further indicates a sophisticated, multi-stage campaign targeting Linux server infrastructure at scale. This incident underscores how trojanized software and log suppression can silently undermine an organization's entire server estate.",[156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 8: Audit Log Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components",{"MITRE ATT&CK T1566: Phishing":164,"CIS Control 8: Audit Log Management":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"OWASP A06:2021 Vulnerable and Outdated Components":167,"CIS Control 2: Inventory and Control of Software Assets":168,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":169,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":170},"While delivery here was via trojanized software rather than phishing, the ATT&CK supply-chain compromise technique (T1195) pattern applies — attackers substituted a legitimate tool with a malicious variant to gain initial access undetected.","CWPdoor actively suppresses local logging; centralizing and protecting audit logs in a tamper-resistant system would have exposed the gap in log data as an early indicator of compromise.","Timely identification and patching of vulnerabilities in internet-facing components like CWP would reduce the window of opportunity attackers exploit to deliver trojanized updates.","The use of a trojanized third-party server component directly maps to this risk category, highlighting the need to continuously verify the integrity and provenance of all software dependencies running on production servers.","Maintaining an authoritative inventory of approved software and verifying installed binaries against it would have flagged the trojanized cwpsrv component before it could establish persistence.","A formal technical vulnerability management process covering third-party hosting software would require integrity verification of server components and prompt remediation when trojanized versions are identified.","Restricting access to CWP management interfaces to authenticated, authorized users over VPN would have dramatically reduced the 340,000+ publicly exposed attack surface exploited in this campaign."]