A new Linux malware named CWPdoor is being distributed through a trojanized version of cwpsrv, the web server for the Control Web Panel (CWP) management interface. This malware acts as a passive backdoor, remaining dormant until activated by a specially crafted request from the attacker.
Researchers at XLab have described CWPdoor as 'exceptionally stealthy' due to its passive triggering mechanism and its ability to suppress logs. The malware was discovered on June 29 after a script was found replacing the legitimate 'cwpsrv' binary with a malicious version.
The script replaces cwpsrv versions 1.15.10 and 1.24.0, taking steps to conceal the replacement by restoring file and directory timestamps. The backdoor checks if the timestamp falls within a five-minute window and verifies an RSA signature before executing commands.
More than 340,000 CWP instances have been exposed on the public web over the past month, raising concerns about the potential scale of the impact. CWPdoor was uploaded to VirusTotal on September 30, along with the Ebury backdoor, with the malicious cwpsrv file showing zero detections.
The presence of real victims in the wild has been confirmed, indicating that the malware is actively being exploited.