CWPdoor: The Invisible Backdoor Living Inside Control Web Panel

XLab, the threat-research team at QiAnXin, describes cwpdoor, a backdoor built into a recompiled cwpsrv, the web server of Control Web Panel. A script swaps it in for versions 1.15.10 and 1.24.0, resets file timestamps, and the backdoor runs RSA-signed, AES-encrypted commands sent in HTTP headers while suppressing log entries. A Brazilian VirusTotal upload suggests real victims, though the claims rest on XLab's own telemetry. The infection vector and any link to Ebury are unknown. Hunter data shows over 340,000 exposed CWP instances. Administrators can check for the ngx_http_integrity_helper socket.