[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

confirmed research (QiAnXin XLab, Nov 5); how attackers first get root on the servers is not known

Hunt: 'cwpdoor' replaces Control Web Panel's cwpsrv web server with a recompiled backdoor that runs signed commands and hides them from access logs

  • On CWP servers: look for a ngx_http_integrity_helper Unix socket, unexpected cwpsrv helper processes, and the string X-Ngx-Integrity in /usr/local/cwpsrv/bin/cwpsrv (e.g. strings ... | grep -i integrity).
  • Network: downloads from 136.0.141[.]71 (/static/cwpsrv_update.sh, /static/cwpsrv_1.15.10, /static/cwpsrv_1.24.0). Requests with X-Ngx-Integrity-Data/-Time/-Sig headers seen at a reverse proxy or WAF in front of CWP.
  • MD5: script e505d4ffa21cf494a5dc2d7c8f4f1236; cwpsrv 1.15.10 965aea67fb40de1bab5169ada993349f; cwpsrv 1.24.0 d3f4e95113d49ab3991b45e457bda75b.
  • Also check for Ebury, since the two turned up together.
  • If found: replace the binary with a clean copy, upgrade CWP, rotate all panel credentials, and treat the host as root-compromised (the installer needs root).

Sources: XLab: CWPdoor: The Invisible Backdoor Living Inside Control Web Panel (Nov 5) · BleepingComputer: Hackers backdoor Linux servers using trojanized CWP web server (Nov 5)