Follow us on Google News
Cybersecurity researchers have discovered a stealthy Linux backdoor hidden inside legitimate-looking web server software, allowing hackers to execute commands on compromised systems while preventing their activity from appearing in ordinary access logs.
The malware, named CWPdoor, targets Control Web Panel (CWP), a server management application widely used by website administrators and hosting providers.
Researchers disclosed the findings on November 5, 2026, warning that more than 340,000 CWP installations had been exposed to the internet during the preceding month.
However, that figure represents potentially exposed systems, not confirmed infections.
The attack involves replacing a legitimate server component with a modified version containing hidden malicious functionality. Once installed, the backdoor remains largely inactive until the attacker sends a specially constructed request.
The technique could allow criminals to maintain access to compromised servers without generating the usual warning signs associated with suspicious commands.
Malicious Update Replaces Legitimate Server Software
Control Web Panel, formerly known as CentOS Web Panel, is used to manage websites, email services, databases and domain name settings on Linux servers.
It provides a graphical interface that allows administrators to control these services without manually entering complex commands.
The newly identified malware targets cwpsrv, the web server component responsible for running CWP’s management interface.
Researchers first encountered the attack on June 29, when they discovered a suspicious script named cwpsrv_update.sh.
The script appeared to perform a routine software update. Instead, it downloaded a malicious replacement for the legitimate cwpsrv program from an attacker-controlled server.
Investigators identified modified software targeting two versions, 1.15.10 and 1.24.0.
The script required administrator-level privileges to operate. After checking the installed version, it downloaded the corresponding malicious file, stopped the existing service and replaced the legitimate executable.
It then restarted the service and checked whether the replacement was functioning.
If the operation failed, the script could restore the original program. If successful, it deleted temporary files and removed evidence associated with the replacement.
The malware also restored the original timestamps of affected files and directories.
Consequently, an administrator checking when the server software was last modified might see dates suggesting that nothing unusual had happened.
The script additionally attempted to erase its command-history entry, making the modification harder to discover during a routine inspection.
Backdoor Activates Only When Hackers Send Special Requests
Unlike malware that continuously contacts a remote command server, CWPdoor operates as a passive backdoor.
During ordinary activity, the modified server continues handling legitimate web requests.
Its malicious functions activate only when a request contains specific hidden instructions.
The attackers use specially prepared HTTP headers carrying an encrypted command, a timestamp and a digital signature.
The malware checks whether the timestamp falls within a permitted five-minute window and verifies the accompanying signature before accepting the request.
If the verification succeeds, the hidden command is decrypted and passed to a separate helper process for execution.
The results are then encrypted and returned to the attacker through the web server’s normal communication channel.
This design makes suspicious activity harder to distinguish from legitimate traffic because the command exchange takes place through an existing web service.
More importantly, the malware interferes with the server’s logging system.
When a malicious request activates the backdoor, CWPdoor suppresses the corresponding access-log entry.
Access logs ordinarily help administrators identify suspicious connections, investigate incidents and reconstruct how attackers interacted with a server.
Removing these records can make investigations more difficult, particularly when no other security monitoring system captures the activity.
Researchers Find Malware Undetected In VirusTotal Sample
The investigation uncovered further evidence that CWPdoor had appeared on systems outside the researchers’ controlled environment.
On September 30, an archive named evidencia.tgz was uploaded to VirusTotal from Brazil.
VirusTotal is an online service that allows files to be checked against multiple security detection engines.
The archive contained two suspicious files.
One was associated with Ebury, a previously documented Linux backdoor and credential-stealing operation.
The other was a modified cwpsrv executable identified as CWPdoor.
While security products recognised the Ebury-related file, the CWPdoor sample received no detections in the analysis described by the researchers.
The finding indicates that the malware was capable of escaping conventional signature-based detection at that point.
Researchers also regarded the archive as evidence that CWPdoor had reached real-world systems rather than existing solely as an experimental tool.
However, they could not determine whether the two malware families were deployed by the same attackers.
It is possible that separate groups compromised the same server at different times.
The researchers have not identified the people responsible for CWPdoor or established how attackers initially obtained the access required to replace the legitimate software.
Server Administrators Urged To Check For Hidden Infection
The discovery creates a particular concern for hosting providers because server management panels often have access to sensitive configuration information and administrative functions.
If hackers gain control of such infrastructure, they may be able to interfere with websites, access stored credentials or install additional malicious software.
Researchers identified several technical indicators that administrators can use to investigate possible infections.
These include a suspicious internal communication socket named ngx_http_integrity_helper, unexpected helper processes associated with cwpsrv and strings containing X-Ngx-Integrity inside the server executable.
Administrators who identify a confirmed infection are advised to replace the compromised executable with a verified legitimate copy, update their server software and rotate control-panel credentials.
They should also examine the affected machine for other malware or evidence of unauthorised activity.
The research does not establish that CWP itself distributed an infected official update or that all publicly exposed installations are compromised.
The important development is the discovery of a modified server component capable of concealing remote command execution inside software that administrators ordinarily trust.
What This Means For You:
Website owners and hosting providers using Control Web Panel should check for the published indicators of compromise and ensure their server software comes from trusted sources. A server that appears to function normally may still require investigation if its administrative components have been replaced.
