Linux backdoor CWPdoor hides in trojanized CWP panel server cwpsrv and suppresses access logs

QiAnXin XLab says it captured a suspicious script, cwpsrv_update.sh, on June 29 that downloads a backdoored, recompiled cwpsrv to replace the legitimate Control Web Panel (CWP) binary; the backdoor runs attacker commands only on specially crafted requests and suppresses logging for them ^[1]. XLab says more than 340,000 CWP instances were internet-exposed over the past month and that a sample uploaded to VirusTotal on September 30 had zero detections, indicating real victims exist ^[1][2]. CWP administrators should check hosts against XLab indicators and, if infected, restore cwpsrv from the attacker-created backup, upgrade to the latest version and immediately rotate all control panel credentials ^[1].

Industries mainly affected: Cross-industry

XLab says more than 340,000 CWP instances were internet-exposed over the past month and that a sample uploaded to VirusTotal on September 30 had zero detections, indicating real victims exist ^[1]