[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

vendor research (QiAnXin XLab, Nov 5); XLab says a VirusTotal upload indicates real victims but gives no count; initial access unknown

Hunt: cwpdoor, a rebuilt Control Web Panel cwpsrv that runs signed commands from X-Ngx-Integrity headers and keeps them out of access logs

  • Checks: ss -axp | grep integrity (socket ngx_http_integrity_helper); strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity; unexpected helper children of cwpsrv in ps.
  • IOCs: download host 136.0.141[.]71 (/static/cwpsrv_update.sh, /static/cwpsrv_1.15.10, /static/cwpsrv_1.24.0); MD5 e505d4ffa21cf494a5dc2d7c8f4f1236 (installer), 965aea67fb40de1bab5169ada993349f (1.15.10), d3f4e95113d49ab3991b45e457bda75b (1.24.0).
  • Network: the backdoor returns results as HTTP 200 application/octet-stream on the panel port; look for that on CWP panel traffic.
  • The Brazil VirusTotal archive also held Ebury; XLab doesn't know if they're related.

Sources: QiAnXin XLab: CWPdoor, the invisible backdoor living inside Control Web Panel (Nov 5) · The Hacker News: hackers hide Linux backdoor in Control Web Panel server (Nov 6)