Attackers are rebuilding the web server inside Control Web Panel so it executes commands without leaving a trace in access logs. Researchers at QiAnXin’s XLab named the implant cwpdoor and say real infections exist.
Why log review cannot find it
cwpdoor is cwpsrv, the panel’s web server, recompiled with extra code. It behaves like the stock binary until a request arrives carrying a valid timestamp and signature in custom headers named with the X-Ngx-Integrity prefix. Then it runs whatever command the request contains. Because the handler sits below the logging layer, the requests never appear in the access log.
Installing it requires root, so the operator must already control the host, and XLab does not yet know how that access is obtained. The installer, a shell script posing as a version update, handles only cwpsrv 1.15.10 and 1.24.0, and restores original timestamps after swapping the binary so ls and stat look normal.
Evidence of live victims
XLab captured the installer on June 29. On September 30 an archive holding a backdoor copy was uploaded to VirusTotal from Brazil, which the researchers read as proof real victims exist, though they give no count. When they checked, the file had zero detections out of 63 engines.
Three checks to run today
Hosting providers and anyone running the panel should look in three places. List sockets for ngx_http_integrity_helper, the Unix socket the implant opens. List cwpsrv processes and flag unexpected helpers. Inspect binary strings for the X-Ngx-Integrity header names.
In XLab’s sample the socket check caught an infection on a server whose open-port list looked ordinary, meaning host-based network scanning would have missed it. Servers built from version 1.15.10 or 1.24.0 should be treated as suspect until those checks come back clean, and a hit means rebuild, not clean.
