What Happened
QiAnXin’s XLab found a backdoor it calls cwpdoor in Control Web Panel, a tool used to manage Linux hosting servers, The Hacker News reports. The backdoor is a modified build of cwpsrv, the panel’s web server. It behaves normally until it receives a request with a valid timestamp and signature in headers starting with X-Ngx-Integrity. It then runs the command inside the request. Those requests never appear in access logs.
The installer is a shell script disguised as a version update. It targets cwpsrv 1.15.10 and 1.24.0 and resets file timestamps, so ls and stat show no change. The backdoored file scored zero detections on VirusTotal. Installation needs root, and XLab has not found how attackers get it. XLab captured the installer on June 29, and an archive with the backdoor reached VirusTotal from Brazil on September 30. The archive also held Ebury, an OpenSSH backdoor active since at least 2009.
Why This Matters for Canadian Organizations
Control Web Panel runs on small hosts, web agencies, and in-house servers across Canada. XLab gives no count of infected servers, so exposure is unknown. A compromised panel server holds client websites, databases, and mailboxes. If personal information sits on it, PIPEDA breach rules apply, and you must assess real risk of significant harm. Because the backdoor leaves no log trail, silence in your logs proves nothing.
What to Do
Run ss -axp | grep integrity on every CWP server. A socket named ngx_http_integrity_helper means infection. Check the binary with strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity. Block traffic to 136.0.141.71 and search for the cwpsrv_update.sh installer. If you find a hit, treat the whole server as compromised. Restore cwpsrv from the cwpsrv.prev backup if it exists, upgrade CWP, and change all panel credentials. Look for Ebury as well. Read more TechTalk coverage and our latest news.
