Hackers backdoor Linux servers using trojanized CWP web server

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.

CWPdoor acts as a passive backdoor that sits dormant on the compromised system until the attacker sends a specially crafted request.

Researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, describe CWPdoor as "exceptionally stealthy" due to its passive triggering and log suppression feature.

CWP, formerly known as CentOS Web Panel, is an open-source web hosting administration solution similar to cPanel and Plesk that allows users to manage web servers and services such as email, DNS, and databases.

According to XLab, more than 340,000 CWP instances have been exposed on the public web over the past month.