CWPdoor Malware Exposes Linux Servers to Stealthy Backdoor Attacks

• •CWPdoor malware targets Control Web Panel installations, affecting over 340,000 servers.
• •The malware operates as a passive backdoor, remaining dormant until triggered by specific requests.
• •Indicators of compromise include the ngx_http_integrity_helper socket and modified cwpsrv processes.

Researchers have identified a new Linux backdoor malware named CWPdoor, which targets the Control Web Panel (CWP) server management software. The malware is hidden within a trojanized version of the cwpsrv binary, affecting over 340,000 installations exposed on the internet. Discovered on June 29, 2026, CWPdoor operates as a passive backdoor, remaining dormant until triggered by specially crafted HTTP requests that suppress logging. This stealthy approach allows attackers to execute commands without detection. The malware uses encrypted HTTP headers for command execution and is linked to the Ebury botnet, which has previously compromised numerous servers. Administrators are advised to check for specific indicators of compromise and to replace the malicious binary if detected.