CWPdoor Backdoor Hides in Trojanized CWP Web Server
Summary
XLab says CWPdoor is distributed through a trojanized CWP web server. The passive backdoor accepts signed, encrypted HTTP commands and suppresses access logs; researchers recommend checking for indicators and replacing compromised binaries.
Key points
- XLab researchers found an updater script that replaced legitimate cwpsrv binaries with trojanized versions, while hiding the change by restoring timestamps and deleting traces.
- CWPdoor waits for a specially crafted HTTP request containing encrypted commands and timestamp and RSA-signature headers.
- The backdoor checks the signature and a five-minute timestamp window, then decrypts commands using AES-256-CBC and passes them to a helper process.
- CWPdoor interferes with server logging so the triggering request does not appear in access logs.
- XLab reported more than 340,000 CWP instances exposed on the public web over the preceding month; the article does not establish how many were compromised.
- Researchers found a malicious cwpsrv file in an archive uploaded to VirusTotal. They said its zero detections suggested real victims existed, while noting that CWPdoor’s connection to Ebury remains unclear.
- Administrators are advised to check for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings; if compromised, replace the binary, update CWP, rotate credentials, and investigate for other malware.
Article Details
- Attack Vectors
- A script posing as an updater replaced the legitimate cwpsrv binary with a malicious version.
- CWPdoor remains dormant until activated by a specially crafted HTTP request containing encrypted commands and timestamp and RSA-signature headers.
- The malware verifies the request signature and timestamp before passing the command to a helper process for execution.
- Defensive Notes
- Check for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings in the server binary.
- If compromise is confirmed, replace the backdoored binary with a legitimate copy, upgrade to the latest version, rotate control panel credentials, and investigate the host for additional malware.
MITRE ATT&CK
T1036 · MasqueradingThe infection script posed as an updater while replacing cwpsrv.T1070.003 · Clear Command HistoryThe script wiped the command-history log to hide traces of the binary replacement.T1070.006 · TimestompThe script restored file and directory timestamps after replacing cwpsrv.T1071.001 · Web ProtocolsCWPdoor receives activation commands in a specially crafted HTTP request.T1554 · Compromise Host Software BinaryThe campaign replaced the legitimate cwpsrv binary with a trojanized version.T1562.006 · Indicator BlockingCWPdoor interferes with the server's logging module so its triggering request does not appear in access logs.T1573.001 · Symmetric CryptographyCWPdoor encrypts commands and their output with AES-256-CBC.
Malware
CWPdoorA new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.EburyAfter finding the initial infection script, the researchers saw CWPdoor uploaded to VirusTotal on September 30 in an archive that included the Ebury backdoor.
Products
Control Web PanelA new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.cwpsrvA new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.