Cybersecurity researchers at QiAnXin XLab have identified a stealthy Linux backdoor, named CWPdoor, hidden inside the web server component used by Control Web Panel (CWP), a free platform for managing Linux hosting servers. The malware allows attackers to remotely execute commands on compromised systems while concealing their activity from routine server logs. Researchers explained that installing the backdoor requires root-level privileges, meaning an attacker must already have administrative access to a server before deploying it. XLab first detected a suspicious installation script on June 29, 2026. Disguised as a legitimate software update, the script replaced the original CWP web server component with a modified version containing the malicious code. The installer was designed to target two versions of the server component, 1.15.10 and 1.24.0. However, researchers have not established how attackers initially obtain the privileged access needed to carry out the installation. On September 30, an archive containing a copy of the malware was uploaded to VirusTotal from Brazil. According to XLab, this suggests that real systems have been compromised, although the number of affected servers remains unknown. The findings were detailed in a technical analysis published by XLab.
According to the researchers, CWPdoor is built directly into a modified version of the legitimate server software rather than operating as a separate application. This allows the affected server to continue functioning normally, making the infection harder to notice through routine checks. The backdoor activates when it receives specially prepared web requests containing hidden instructions. It verifies the request before carrying out commands on the compromised system, while also preventing the triggering activity from appearing in standard access logs. The installer further attempts to hide the replacement of the original server software by preserving its previous file timestamps. As a result, basic checks of file dates and properties may not reveal that the software has been modified. XLab also reported that the malicious server component had not been detected by any of the 63 antivirus engines on VirusTotal at the time of its analysis. Researchers demonstrated that administrators could look for signs of the malware by checking for an unusual internal communication connection, investigating unexpected processes associated with the CWP web server and examining the server software for traces of the backdoor. They noted that one of these checks could identify the malware even when the server’s list of open network ports appeared normal. These findings indicate that conventional monitoring methods may not be sufficient to identify this type of compromise.
XLab has also shared technical indicators that security teams can use to investigate possible infections. These include identifying information for the malicious installation script and the two modified versions of the server software, along with the external server and download locations associated with the malware. Administrators can use these details to check whether suspicious files or network activity are present in their environments. For systems where CWPdoor is confirmed, researchers recommend restoring a clean version of the affected server component. The installer may create a backup of the original software before replacing it, but that backup is not always retained. If it is unavailable, administrators should obtain a verified clean copy rather than relying on a potentially modified file. Researchers also advise changing control panel credentials because the malware can execute commands with extensive system privileges. Removing the backdoor alone should not be treated as sufficient recovery. Organizations should investigate the affected server for other signs of unauthorized access, review privileged accounts and check whether additional malicious software has been installed. Hosting providers and system administrators should also assess the integrity of their server software and strengthen controls around administrative access to reduce the risk of similar incidents.
The archive submitted to VirusTotal also contained a software component associated with Ebury, a long-running malware family known for targeting Linux servers and stealing credentials. Ebury has previously been linked to compromises involving OpenSSH, but XLab has not confirmed whether it is connected to CWPdoor. Researchers said both malware families may have been present on the same server without necessarily being deployed by the same attackers. Their relationship therefore remains uncertain. The discovery highlights the risks associated with compromised administrative accounts and the replacement of legitimate server components with malicious versions designed to avoid detection. CWP administrators and hosting providers should review their systems using the indicators published by XLab, verify that their server software has not been modified and investigate unusual processes or internal connections. The findings do not establish that Control Web Panel itself contains a vulnerability responsible for the infections, nor do they suggest that every CWP installation is affected. The method used to gain the initial root access remains unknown, and researchers have not disclosed the total number of compromised systems.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
