---
title: Hunt: 'cwpdoor' replaces Control Web Panel's cwpsrv web server with a recompiled backdoor that runs signed commands and hides them from access logs | ctxsec
url: https://ctxsec.com/items/hunt-xlab-cwpdoor-trojanized-cwpsrv-control-web-panel-passive-backdoor
description: "XLab captured a script on June 29 posing as a cwpsrv update. Run as root, it downloads a trojanized cwpsrv (for CWP versions 1.15.10 or 1.24.0) from 136.0.141.71, swaps it into /usr/local/cwpsrv/bin/cwpsrv, restarts the service, rolls back if health checks fail, and wipes temp files, backups, timestamps and shell history. The backdoor is the real cwpsrv source with malicious code compiled in: it stays passive until it receives an RSA-signed, AES-256-CBC-encrypted command in X-Ngx-Integrity-* headers within a \u00b1300-second window, runs it through a helper process, and suppresses the access-log entry. A copy found on VirusTotal on Sept 30 sat beside the Ebury SSH backdoor and had zero detections, which XLab says means there are real victims; the Ebury link is unclear. XLab counts over 340,000 internet-exposed CWP instances."
status: "confirmed research (QiAnXin XLab, Nov 5); how attackers first get root on the servers is not known"
published: 2026-11-05
---

> XLab captured a script on June 29 posing as a cwpsrv update. Run as root, it downloads a trojanized cwpsrv (for CWP versions 1.15.10 or 1.24.0) from 136.0.141.71, swaps it into /usr/local/cwpsrv/bin/cwpsrv, restarts the service, rolls back if health checks fail, and wipes temp files, backups, timestamps and shell history. The backdoor is the real cwpsrv source with malicious code compiled in: it stays passive until it receives an RSA-signed, AES-256-CBC-encrypted command in X-Ngx-Integrity-* headers within a ±300-second window, runs it through a helper process, and suppresses the access-log entry. A copy found on VirusTotal on Sept 30 sat beside the Ebury SSH backdoor and had zero detections, which XLab says means there are real victims; the Ebury link is unclear. XLab counts over 340,000 internet-exposed CWP instances.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-xlab-cwpdoor-trojanized-cwpsrv-control-web-panel-passive-backdoor.md)

confirmed research (QiAnXin XLab, Nov 5); how attackers first get root on the servers is not known

2026-11-05

### Hunt: 'cwpdoor' replaces Control Web Panel's cwpsrv web server with a recompiled backdoor that runs signed commands and hides them from access logs

- **On CWP servers:** look for a `ngx_http_integrity_helper` Unix socket, unexpected cwpsrv helper processes, and the string `X-Ngx-Integrity` in `/usr/local/cwpsrv/bin/cwpsrv` (e.g. `strings ... | grep -i integrity`).
- **Network:** downloads from `136.0.141[.]71` (`/static/cwpsrv_update.sh`, `/static/cwpsrv_1.15.10`, `/static/cwpsrv_1.24.0`). Requests with `X-Ngx-Integrity-Data`/`-Time`/`-Sig` headers seen at a reverse proxy or WAF in front of CWP.
- **MD5:** script `e505d4ffa21cf494a5dc2d7c8f4f1236`; cwpsrv 1.15.10 `965aea67fb40de1bab5169ada993349f`; cwpsrv 1.24.0 `d3f4e95113d49ab3991b45e457bda75b`.
- **Also check for Ebury**, since the two turned up together.
- **If found:** replace the binary with a clean copy, upgrade CWP, rotate all panel credentials, and treat the host as root-compromised (the installer needs root).

Sources: [XLab: CWPdoor: The Invisible Backdoor Living Inside Control Web Panel (Nov 5)](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/) · [BleepingComputer: Hackers backdoor Linux servers using trojanized CWP web server (Nov 5)](https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/)