bleeping-computer Nov 5, 2026 · Crawled Nov 6, 2026

Hackers backdoor Linux servers using trojanized CWP web server

3 IoCs 1 Malware

AI Summary

Hackers are distributing a new Linux backdoor named CWPdoor through a trojanized version of the cwpsrv binary used in Control Web Panel (CWP), a web hosting management interface. The malware replaces legitimate cwpsrv versions 1.15.10 and 1.24.0, operates passively, and is activated via encrypted HTTP headers containing commands, timestamp, and RSA signature. It uses AES-256-CBC encryption for command and response protection, validates a 5-minute time window, verifies RSA signatures, and suppresses logs to avoid detection. The malware has been observed in the wild with zero detections on VirusTotal, indicating active exploitation.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Ebury →

Indicators of Compromise 3 extracted

Type	Value	Detail
Filename	cwpsrv.suspeito	Details →
Filename	cwpsrv	Details →
Filename	ngx_http_integrity_helper	Details →

MITRE ATT&CK TTPs 5 techniques

T1059 Command and Scripting Interpreter · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1548 Abuse Elevation Control Mechanism · Privilege Escalation