---
title: Hunt: cwpdoor, a rebuilt Control Web Panel cwpsrv that runs signed commands from X-Ngx-Integrity headers and keeps them out of access logs | ctxsec
url: https://ctxsec.com/items/hunt-cwpdoor-control-web-panel-cwpsrv-backdoor-x-ngx-integrity
description: "XLab captured a fake updater, cwpsrv_update.sh, on June 29 that swaps CWP's own web server (cwpsrv 1.15.10 or 1.24.0) for a recompiled copy with a passive backdoor. A request carrying a timestamp, AES-encrypted command and RSA signature in X-Ngx-Integrity-Time/-Data/-Sig headers gets the command run by a helper over a Unix socket, with the request suppressed from logs. The installer needs root, restores file timestamps and wipes history; the backdoored binary had 0/63 VirusTotal detections. XLab counts more than 340,000 internet-exposed CWP instances."
status: "vendor research (QiAnXin XLab, Nov 5); XLab says a VirusTotal upload indicates real victims but gives no count; initial access unknown"
published: 2026-11-07
---

> XLab captured a fake updater, cwpsrv_update.sh, on June 29 that swaps CWP's own web server (cwpsrv 1.15.10 or 1.24.0) for a recompiled copy with a passive backdoor. A request carrying a timestamp, AES-encrypted command and RSA signature in X-Ngx-Integrity-Time/-Data/-Sig headers gets the command run by a helper over a Unix socket, with the request suppressed from logs. The installer needs root, restores file timestamps and wipes history; the backdoored binary had 0/63 VirusTotal detections. XLab counts more than 340,000 internet-exposed CWP instances.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-cwpdoor-control-web-panel-cwpsrv-backdoor-x-ngx-integrity.md)

vendor research (QiAnXin XLab, Nov 5); XLab says a VirusTotal upload indicates real victims but gives no count; initial access unknown

2026-11-07

### Hunt: cwpdoor, a rebuilt Control Web Panel cwpsrv that runs signed commands from X-Ngx-Integrity headers and keeps them out of access logs

- **Checks:** `ss -axp | grep integrity` (socket `ngx_http_integrity_helper`); `strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity`; unexpected helper children of cwpsrv in `ps`.
- **IOCs:** download host `136.0.141[.]71` (`/static/cwpsrv_update.sh`, `/static/cwpsrv_1.15.10`, `/static/cwpsrv_1.24.0`); MD5 `e505d4ffa21cf494a5dc2d7c8f4f1236` (installer), `965aea67fb40de1bab5169ada993349f` (1.15.10), `d3f4e95113d49ab3991b45e457bda75b` (1.24.0).
- **Network:** the backdoor returns results as HTTP 200 `application/octet-stream` on the panel port; look for that on CWP panel traffic.
- The Brazil VirusTotal archive also held Ebury; XLab doesn't know if they're related.

Sources: [QiAnXin XLab: CWPdoor, the invisible backdoor living inside Control Web Panel (Nov 5)](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/) · [The Hacker News: hackers hide Linux backdoor in Control Web Panel server (Nov 6)](https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html)