Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

The malicious software, dubbed cwpdoor, is embedded in the cwpsrv web server itself, which researchers found after analyzing the installer. The backdoor remains dormant until it receives a request with a valid timestamp and signature in custom headers beginning with X-Ngx-Integrity.

Attackers must already have root access to install the backdoor, as the installer script, cwpsrv_update.sh, requires elevated privileges. The researchers believe the installer was uploaded to VirusTotal from Brazil on September 30, indicating that infected servers are already in the wild.

The backdoor is sophisticated, as it restores the original file dates after installation, making it difficult to detect with standard commands like ls or stat. It was not detected by any of the 63 antivirus engines checked on VirusTotal.

Detection and Removal

QiAnXin's XLab has provided specific indicators for administrators to check their servers. The researchers recommend running the command ss -axp | grep integrity to look for the Unix socket the backdoor uses, ngx_http_integrity_helper.

Administrators should also inspect running processes with ps aux | grep cwpsrv for unexpected helper processes and search the cwpsrv binary for the backdoor's header names using strings.

If a server is infected, the researchers recommend restoring the original cwpsrv file from the backup created by the installer, which is located in /usr/local/cwpsrv/bin with a name starting with cwpsrv.prev-. After restoration, administrators should upgrade to the latest version and change all control panel credentials.