Summary
- CWPdoor replaces a legitimate hosting management component with a modified binary containing hidden command-execution functionality.
- Researchers found that the malware can suppress access logs and disguise changes to the affected software.
- More than 340,000 internet-facing Control Web Panel instances were observed, but the number actually infected remains unknown.
Attackers have been distributing a Linux backdoor embedded within modified hosting management software, allowing covert access to compromised servers while concealing malicious activity from conventional access logs.
Researchers at QiAnXin XLab identified the malware, named CWPdoor, inside a replacement version of the web server component used by Control Web Panel.
Rather than operating as an obviously separate malicious process, the backdoor is incorporated into software responsible for serving the legitimate administration interface. It remains passive until activated by a specially constructed request, after which it can execute commands on the affected host.
The researchers have identified malicious samples and deployment infrastructure, although the initial method used to compromise servers and the number of affected installations remain unknown.
Malicious functionality embedded in legitimate software
Control Web Panel, previously known as CentOS Web Panel, provides an interface for administering Linux hosting environments, including websites, email, DNS, and other server resources.
Its administrative functions depend on a dedicated web server component known as cwpsrv, which handles requests to the management panel and associated applications.
XLab identified versions of that component containing additional malicious functionality. The attackers had modified the underlying software and produced replacement binaries that retained normal administrative behaviour while providing a hidden communication channel.
The investigation began after XLab captured a suspicious script on 29 June 2026. The script masqueraded as a software update and was designed to replace an existing cwpsrv executable with a malicious version.
The deployment tool required root privileges and supported two specific cwpsrv versions. It checked the installed software, replaced the relevant component, restarted the service, and verified that the modified process continued operating.
It also attempted to conceal evidence of the replacement by restoring file timestamps and removing traces of its execution from command history.
That behaviour complicates investigations based on the assumption that recently modified malicious files will have identifiable timestamps or that software updates will leave ordinary administrative records.
Once installed, CWPdoor behaves differently from malware that continuously contacts an external command server. The backdoor waits for a request containing information that it can validate before activating its malicious functionality.
Its communication mechanism uses cryptographic checks to distinguish authorised attacker requests from ordinary traffic. After processing a valid instruction, the modified server passes the command to a helper process and returns the result through the web connection.
The backdoor also suppresses the access-log entry associated with the malicious request, reducing the visibility of its operation through normal web-server records.
Evidence of infections but uncertain scale
XLab identified additional evidence in an archive submitted to VirusTotal from Brazil on 30 September.
The archive contained a suspicious cwpsrv binary alongside a separate Linux backdoor associated with the Ebury malware family.
The researchers found that the malicious cwpsrv component had received no detections from the security engines available during their examination, despite exhibiting the functionality associated with CWPdoor.
That result illustrates the difficulty of identifying modified infrastructure software through conventional malware signatures. It does not establish that the backdoor would evade every security product or detection method.
The presence of Ebury in the same archive also does not establish a common attacker or coordinated campaign. XLab says the relationship between the two malware families remains unclear.
Researchers identified more than 340,000 Control Web Panel instances exposed to the public internet during the preceding month through QiAnXin’s internet scanning platform.
Those systems represent a population of potentially reachable installations, not confirmed CWPdoor infections. The research does not establish how many servers have received the malicious component.
Hosting administration creates wider exposure
Hosting management systems occupy a sensitive position because they provide administrative access to resources used by websites, databases, mail services, and other applications.
Where attackers gain sufficient privileges to replace a management component, the resulting compromise may expose more than the original application. The available permissions can provide access to configuration information, credentials, hosted content, or other services on the same machine.
CWPdoor’s installation process required root privileges, indicating that an attacker would already need substantial access to the host to deploy the observed replacement binary.
The research has not established how that initial access was obtained. It would therefore be inaccurate to describe the malware as exploiting an identified Control Web Panel vulnerability or as capable of compromising any exposed installation without prior access.
The more immediate operational concern is persistence after a server has already been compromised. A modified administrative component can remain functional, making the installation appear normal while preserving an unauthorised method of control.
Investigating that possibility requires more than reviewing the web server’s access logs, particularly when the malicious code is designed to suppress the records associated with its own activity.
XLab has published indicators covering the modified binaries, unexpected helper processes, and communication artefacts. It recommends treating confirmed infections as broader host compromises and rotating relevant administrative credentials.
The researchers are continuing to investigate the backdoor’s distribution and its possible relationship with other Linux malware. The original intrusion method, operator identity, and total number of affected hosts remain unresolved.
