Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Linux hosting server administrators
Incident: Deployment of a stealthy backdoor in the Control Web Panel web server binary.
Impact: Complete system compromise allowing remote command execution with no log traces.
Attacker: Unidentified threat actors
Analysis: The ‘cwpdoor’ malware replaces the legitimate cwpsrv binary with a modified version that triggers command execution via specific custom HTTP headers. It employs stealth techniques by spoofing file timestamps and avoiding standard log entries to maintain persistence. The discovery of this tool alongside Ebury malware suggests highly targeted attacks on hosting infrastructure.
Recommendations: Inspect for the ‘ngx_http_integrity_helper’ Unix socket using ‘ss -axp’.; Scan the cwpsrv binary for ‘X-Ngx-Integrity’ string markers.; Update Control Web Panel to the latest version and rotate all administrative credentials.
Source: The Hacker News / QiAnXin XLab
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source