The malware was discovered by security researchers at XLab, the research division of QiAnXin Technology Group, on June 29 after capturing a malicious shell script. Scripted updates disguised themselves as legitimate software updates, replacing the original cwpsrv binary with a modified version that included a backdoor. Versions of Web Servers 1.15.10 and 1.24.0 were affected. 

The CentOS Web Panel was previously known as the CentOS Web Panel, which is a free open-source web hosting management system for managing Linux servers and services, including email, DNS and databases. A web server component, known as CWPsrv, is responsible for handling requests to the management interface, making this compromise of particular concern to server administrators. During the month preceding the investigation, more than 340,000 CWP instances were exposed on the internet, according to XLab. 

Even though public exposure does not guarantee infection, the number of attacks targeting this software indicates the potential reach of such attacks. 

CWPdoor infections begin with scripts modifying the legitimate CCWPSRV executable with a trojanized version. In addition to installing the malicious binary, the script performs several other actions intended to make detection difficult. As a result, files and directories affected by the virus are restored to their original timestamps, temporary installation files are removed, and command history records are cleared.

Through these methods, the replacement is less visible and routine administrative checks are less effective. The malware does not behave like a conventional backdoor that continually listens for incoming connections, but instead remains dormant until its operators issue a specially constructed HTTP request that triggers its operation. Consequently, ordinary network monitoring is unable to detect the threat due to its passive execution method. 

The compromised web server continues to perform its legitimate functions while maintaining the ability to execute attacker-controlled commands when a valid request arrives. In particular, XLab described the malware as exceptionally stealthy, owing to its request validation mechanism and ability to interfere with server logging. By using these capabilities, a backdoor can be concealed within a trusted component of the server rather than appearing as a standalone process that appears to be suspicious. 

A malicious HTTP request carries three custom headers that are used by CWPdoor to control the execution of attacker commands. CWPdoor utilizes encryption and digital signature verification to ensure that attacker commands are executed in a controlled manner. X-Ngx-Integrity-Data contains an encrypted command; X-Ngx-Integrity-Time specifies a timestamp; and X-Ngx-Integrity-Sig contains an RSA signature. 

The backdoor validates the RSA signature before executing a command. The malware decrypts the command once it has passed these checks and forwards it to the helper process for execution. Both commands and their output are protected using AES-256-CBC encryption. With the signature mechanism, attackers or external parties are also prevented from altering the encrypted payload or timestamp without invalidating the request. 

As a result, the backdoor can only be activated when the request has been correctly signed, providing replay protection. CWPdoor has also been shown to suppress evidence of malicious activity in a significant way. It interferes with the logging module of the web server, preventing regular access log entries from displaying requests that trigger the backdoor. During routine security investigations, this can lead to administrators lacking crucial evidence. 

The analysis indicated that the CWPdoor sample had been uploaded to VirusTotal on September 30, along with the Ebury backdoor. Researchers discovered that the trojanized cwpsrv binary did not receive a single antivirus detection out of 63 security products tested. The discovery indicates that the malware has reached beyond testing and is already present on compromised systems. 

It is unclear, however, whether CWPdoor and Ebury are operated by the same threat actors or whether they were installed independently on the same server. Ebury is an extensive Linux malware operation known for its backdoors and credential stealing capabilities. Since the malware was first identified in 2009, ESET reported that nearly 400,000 servers were compromised. 

This malware has been identified by XLab. It is recommended that administrators inspect CWP servers for specific indicators associated with it. These include the ngx_http_integrity_helper Unix socket, unexpected helper processes launched by cwpsrv, and strings containing X-Ngx-Integrity. It is also recommended to check the integrity of the cwpsrv executable rather than relying on file timestamps, because the malicious installer may restore the values of the file timestamps to conceal unauthorized modifications, according to researchers. 

A legitimate copy of the web server binary should be restored by administrators, the CWP must be updated to the newest version, and all control panel credentials must be rotated. Furthermore, the affected host should be subjected to an extensive security investigation to determine whether it has been infected with malware or unauthorized access.

Because CWPdoor is capable of executing attacker-supplied commands, replacing the compromised binary may not be sufficient to secure the system. Server credentials, including privileged access accounts, should be treated as potentially vulnerable.