BleepingComputer reports that CWPdoor, a Linux backdoor, is being distributed through a trojanized version of cwpsrv, the web server behind Control Web Panel (CWP).
The attackers tamper with the server component rather than relying on access through CWP’s management interface. When compromised cwpsrv runs, it can install the backdoor; keeping the panel off the public internet therefore does not establish that a host is clean.
That shifts the trust boundary from the visible management panel to the software component serving it. For hosting providers with CWP installations, a panel-exposure inventory alone can miss affected servers; the reporting does not establish how broadly the trojanized cwpsrv has been distributed.
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.