Hackers backdoor Linux servers using trojanized CWP web server

Researchers at QiAnXin’s XLab describe CWPdoor, a passive Linux backdoor distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel hosting interface used on more than 340,000 internet-exposed instances. The malware sits dormant until the attacker sends a specially crafted, signed and encrypted HTTP header, suppresses logging of the trigger request, and was found in an archive alongside the Ebury backdoor. Administrators are advised to check for the malware’s helper socket and strings, replace the binary, and rotate control panel credentials.