The Server Is Backdoored. The Logs Never Saw It.

Every investigation starts with the logs. So consider a backdoor that executes attacker commands through a server’s normal web traffic — and arranges for those requests to never appear in the access logs at all. That is cwpdoor, a backdoor found hiding inside the web server that powers Control Web Panel, the free Linux hosting panel running on a great many servers.

What happened

The discovery comes from researchers at QiAnXin XLab, who captured the backdoor’s installer on June 29: a shell script named cwpsrv_update.sh, dressed up as a routine version update. The installer swaps the panel’s web server binary, cwpsrv, for a rebuilt version carrying extra code. It handles two cwpsrv versions — 1.15.10 and 1.24.0 — and, once the swap is done, it restores the file’s original timestamps, so everyday checks with ls or stat show a file that looks untouched.

The rebuilt binary behaves like the genuine article until a request arrives carrying a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. Then it runs the command embedded in the request — as the server — and the request is kept out of the access logs. When researchers checked the backdoored file against VirusTotal, it scored zero detections out of 63 engines. An archive containing a copy of the backdoor was uploaded to VirusTotal from Brazil on September 30, which the researchers read the obvious way: real victims already exist. The same archive also contained Ebury, a long-running OpenSSH backdoor and credential stealer, though whether the two infections are related is unknown.

One fact cuts both ways: installing cwpdoor takes root access, so whoever planted it already controlled the server. How that first root access is being obtained is not yet known. cwpdoor is not the break-in — it is what the intruder leaves behind to make sure the break-in never has to happen twice.

Why this one matters

Control Web Panel is popular precisely because it puts full hosting administration — websites, email, databases, DNS — behind one friendly panel, often on small and lightly managed servers. A backdoor inside the panel’s own web server inherits all of that reach, and it is engineered to defeat the first moves of an incident response: the logs are clean by design, the file dates are forged, and antivirus sees nothing. An admin can look directly at an infected server and find every surface signal reassuring.

And because installation requires root, finding cwpdoor means the server’s compromise is bigger than one binary. Credentials, customer sites, mail stores — everything on the box has to be treated as exposed, not just the panel.

What to do now

• Run the socket check. ss -axp | grep integrity — a result naming ngx_http_integrity_helper, the Unix socket the backdoor uses, is a sign of infection. In the researchers’ own example, this check caught a server whose open ports looked completely normal.
• Run the process and file checks. ps aux | grep cwpsrv and look for unexpected helper processes spawned by cwpsrv; then strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity to look for the backdoor’s header names in the binary itself. Three quick commands, run on every CWP server you own.
• If a server is infected, clean it properly. Restore the original cwpsrv from the installer’s backup copy (named with a cwpsrv.prev- prefix in /usr/local/cwpsrv/bin) if it still exists, upgrade CWP to the latest version, and re-run the socket check to confirm it comes back clean.
• Rotate everything and hunt wider. Change all control panel credentials — the backdoor can run any command, so assume every secret on the box is known. Treat the whole server as compromised, review it for additional threats, and check logs and firewall records for contact with the known download server at 136.0.141.71.

The lesson here is uncomfortable for anyone who manages servers by dashboard: the absence of evidence in your logs is only meaningful if the thing you are hunting cannot edit the logs. cwpdoor can. The three checks above take minutes — which is a very cheap price for knowing whether the quiet server in the corner is actually yours.