CWPdoor: Trojanized CWP Exploits Linux Servers

At-A-Glance Incident Diagnostic Telemetry

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. CWPdoor acts as a passive backdoor that sits dormant on the compromised system until the attacker sends a specially crafted request. The malware is exceptionally stealthy due to its passive triggering and log suppression feature.

The researchers at XLab discovered the CWPdoor malware on June 29 after capturing a script posing as an updater that replaced the legitimate 'cwpsrv' binary with a malicious version. The malware operators activate the backdoor by sending it commands to be executed, in the form of an encrypted HTTP header (X-Ngx-Integrity-Data).

The backdoor checks whether the timestamp falls within a five-minute window and verifies the RSA signature before decrypting the command and passing it to a helper process for execution. The backdoor also interferes with the server's logging module to prevent the triggering request from appearing in the access logs.

2. Business Impact & Perimeter Exposure

The CWPdoor malware has the potential to cause significant business impact, including data breaches, system compromise, and disruption of critical services. The fact that over 340,000 CWP instances have been exposed on the public web over the past month increases the risk of widespread exploitation and compromise.

3. Compliance & Governance Blast Radius

The CWPdoor malware may trigger various regulatory compliance requirements, including GDPR Art. 33, NIS2, and other data protection regulations, depending on the affected sector and geography. Organizations that have been compromised by the malware may need to notify affected parties and take remediation steps to prevent further damage.

---

Malware Execution Mechanics & Attack Chain

Ingress, Dropper & Persistence Architecture

The CWPdoor malware replaces cwpsrv versions 1.15.10 and 1.24.0, and takes several steps to hide the switch, like restoring file and directory timestamps, deleting temporary files, and wiping the command-history log. The malware uses the AES-256-CBC cipher to encrypt commands and their output, and the RSA signature to verify the authenticity of the commands.

The backdoor mechanism provides replay protection and authorization control by binding the three fields together (timestamp, ciphertext, and RSA signature) and enforcing a ±300-second time window. The researchers recommend that administrators check for the ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes, and X-Ngx-Integrity strings in the server binary.

If a compromise is confirmed, the recommended remediation steps include replacing the backdoored binary with a legitimate copy, upgrading to the latest version, rotating all control panel credentials, and investigating the host for additional malware.

The connection between Ebury and CWPdoor remains unclear, but the fact that the malicious cwpsrv file had zero detections on VirusTotal indicates that the campaign was not merely experimental and real victims already exist in the wild.

Command-and-Control (C2) & Anti-Forensics Analysis

The adversary gains initial access to the system by exploiting a vulnerable version of cwpsrv, specifically versions 1.15.10 and 1.24.0. The malware is then activated by sending a specially crafted request to the backdoor, which executes the commands and provides the output to the attacker. The backdoor also interferes with the server's logging module to prevent the triggering request from appearing in the access logs, making it difficult to detect the malware.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Attribution

The threat actor behind the CWPdoor malware is currently unattributed, but the connection to the Ebury backdoor and botnet operation suggests a potential link to a known threat actor. The motivation behind the campaign appears to be the exploitation of vulnerable Linux servers for malicious purposes, such as data theft, ransomware, or other types of cyber attacks.

---

SOC Defense & Incident Response Playbook

1. Endpoint Quarantine & Host Remediation

• Immediately isolate compromised hosts from the local subnet via EDR network containment.
• Terminate suspicious parent-child process chains and remove unauthorized startup services and scheduled tasks.

2. Perimeter C2 Severance & Firewall Rules

• Block all outbound connections to identified C2 IP addresses and suspicious dynamic DNS domains.
• Implement strict DNS sinkholing to capture and redirect beaconing endpoints for forensic review.

3. Behavioral Detection & Hunting Query

Sigma Rule: CWPdoor Threat Activity

title: CWPdoor Malware Detection
description: Detects the presence of CWPdoor malware
author: XLab
logsource:
  product: linux
  service: auditd
detection:
  selection:
    - ngx_http_integrity_helper
  condition: selection

Microsoft Sentinel Hunting Query (KQL)

null

4. Verification & Behavioral Audit Checklist

• Check for the presence of the ngx_http_integrity_helper Unix socket
• Investigate suspicious cwpsrv helper processes
• Search for X-Ngx-Integrity strings in the server binary
• Replace the backdoored binary with a legitimate copy
• Upgrade to the latest version of cwpsrv
• Rotate all control panel credentials
• Investigate the host for additional malware

---

Indicators of Compromise (IOCs)

---