hacker-news Nov 6, 2026 · Crawled Nov 8, 2026

Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

5 IoCs 1 Malware

AI Summary

A backdoor named 'cwpdoor' has been discovered in the Control Web Panel (CWP) server, a tool used for managing Linux hosting servers. The malicious version of the cwpsrv binary allows attackers to execute commands via specially crafted HTTP requests with custom headers starting with X-Ngx-Integrity, which are not logged. The backdoor is installed via a shell script that replaces the legitimate cwpsrv binary and hides its modifications by restoring original file timestamps. Researchers identified multiple IOCs including hashes, a malicious IP address, and URLs used for distribution, and recommend checking for infection using socket, process, and file indicators.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Ebury →

Indicators of Compromise 5 extracted

Type	Value	Detail
MD5	e505d4ffa21cf494a5dc2d7c8f4f1236	Details →
MD5	965aea67fb40de1bab5169ada993349f	Details →
MD5	d3f4e95113d49ab3991b45e457bda75b	Details →
IP	136[.]0[.]141[.]71	Details →
Filename	cwpsrv_update.sh	Details →

MITRE ATT&CK TTPs 5 techniques

T1059 Command and Scripting Interpreter · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1548 Abuse Elevation Control Mechanism · Privilege Escalation