XLab Details CWP Backdoor That Executes Commands Without Access Logs
Summary
QiAnXin’s XLab says cwpdoor is a modified cwpsrv web server that executes commands from specially signed, timestamped requests without logging them. Its installer needs root access; researchers do not know how attackers obtain it.
Key points
- XLab says cwpdoor is a rebuilt cwpsrv web server with extra code that runs commands carried in requests with valid timestamps and signatures in custom X-Ngx-Integrity headers.
- The researchers captured an installer posing as a version update; it requires root access and handles cwpsrv versions 1.15.10 and 1.24.0.
- XLab does not know how attackers obtain the root access needed to install the backdoor.
- An archive containing a copy of cwpdoor was uploaded to VirusTotal from Brazil; researchers said this suggests real victims exist but gave no infection count.
- The installer restores the replaced file’s original dates, making it appear unchanged in ls and stat checks. At the time of testing, VirusTotal showed zero detections out of 63.
- The archive also contained Ebury, but researchers do not know whether it is related to cwpdoor and said different attackers may have planted the two on the same server.
Article Details
- Attack Vectors
- A shell-script installer disguised as a version update requires root access and replaces cwpsrv with a rebuilt backdoored version.
- The backdoor executes commands sent in web requests when custom headers beginning with X-Ngx-Integrity contain a valid timestamp and signature.
- The backdoor's command requests do not appear in the web server's access logs.
- The installer restores the replaced file's original dates, making it appear unchanged in ls and stat checks.
- Defensive Notes
- Do not rely solely on access logs or file dates from ls and stat to identify this backdoor.
- XLab reported that a socket check detected the backdoor on a server whose open-port list appeared normal.
- XLab recommends checks and response steps for infected servers, but their details are not included in the supplied article.
MITRE ATT&CK
Malware
CWPdoorThe researchers, who named the backdoor cwpdoor, captured its installer, a shell script posing as a version update, on June 29. The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0. TheEburyThe archive uploaded from Brazil also held the Ebury malware, an OpenSSH backdoor and credential stealer active since at least 2009. The researchers do not know whether the two are related, and say different attackers
Products
Control Web PanelA backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week.cwpsrvposing as a version update, on June 29. The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0. The researchers do not yet know how attackers get the root access the installer needs.