CWP Server: cwpdoor Backdoor Hides Command Execution

At-A-Glance Incident Diagnostic Telemetry

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

A backdoor, named cwpdoor, has been discovered in the Control Web Panel (CWP) web server, which executes commands sent via web requests without logging them. The backdoor is hidden in the cwpsrv file and only affects two versions: 1.15.10 and 1.24.0. The attackers must have root access to install the backdoor, and the researchers have not yet determined how this access is obtained. The backdoor has zero detections out of 63 on VirusTotal.

The incident highlights the importance of monitoring web server access logs and ensuring that only authorized users have root access. The researchers recommend three steps to identify and remove the backdoor: checking for suspicious socket activity, verifying the integrity of the cwpsrv file, and monitoring for unusual network activity.

The presence of the Ebury malware, an OpenSSH backdoor and credential stealer, in the same archive as the cwpdoor backdoor raises concerns about the potential for multiple attackers to compromise the same server.

This incident demonstrates the need for vigilance in monitoring web servers and ensuring the integrity of critical system files.

2. Business Impact & Perimeter Exposure

The cwpdoor backdoor has the potential to cause significant business impact if not detected and removed promptly. The backdoor can be used to execute malicious code, steal sensitive information, and persist on the server, making it difficult to detect and remove. The presence of the Ebury malware in the same archive as the cwpdoor backdoor raises concerns about the potential for multiple attackers to compromise the same server.

The incident highlights the importance of monitoring web server access logs and ensuring that only authorized users have root access. The researchers recommend three steps to identify and remove the backdoor: checking for suspicious socket activity, verifying the integrity of the cwpsrv file, and monitoring for unusual network activity.

3. Compliance & Governance Blast Radius

The cwpdoor backdoor may trigger compliance requirements related to web server security and access control. The incident highlights the importance of monitoring web server access logs and ensuring that only authorized users have root access. The researchers recommend three steps to identify and remove the backdoor: checking for suspicious socket activity, verifying the integrity of the cwpsrv file, and monitoring for unusual network activity.

The presence of the Ebury malware in the same archive as the cwpdoor backdoor raises concerns about the potential for multiple attackers to compromise the same server. The researchers do not know whether the two are related, and they suggest that different attackers may have planted them on the same server.

---

Malware Execution Mechanics & Attack Chain

Ingress, Dropper & Persistence Architecture

The cwpdoor backdoor is a custom-built backdoor hidden in the cwpsrv file of the Control Web Panel (CWP) web server. The backdoor is designed to execute commands sent via web requests, which are not logged in the server's access logs. The installer for the backdoor is a shell script posing as a version update, and it only handles two versions of the web server: cwpsrv 1.15.10 and 1.24.0.

The backdoor is activated when a request arrives with a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. The backdoor then runs the command carried in the request. The installer replaces the cwpsrv file with the backdoored version, and it resets the file's dates to their original values, making it appear unchanged.

The researchers recommend checking for suspicious socket activity, verifying the integrity of the cwpsrv file, and monitoring for unusual network activity to identify and remove the backdoor. They also suggest monitoring web server access logs to detect any unusual activity.

The presence of the Ebury malware in the same archive as the cwpdoor backdoor raises concerns about the potential for multiple attackers to compromise the same server. The researchers do not know whether the two are related, and they suggest that different attackers may have planted them on the same server.

Command-and-Control (C2) & Anti-Forensics Analysis

The attackers must have root access to install the cwpdoor backdoor, and the researchers have not yet determined how this access is obtained. Once the backdoor is installed, the attackers can execute commands on the server without leaving any logs. The backdoor is activated when a request arrives with a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. The attackers can then run the command carried in the request, which can be used to execute malicious code or steal sensitive information.

The attackers can also use the backdoor to persist on the server, making it difficult to detect and remove. The presence of the Ebury malware in the same archive as the cwpdoor backdoor raises concerns about the potential for multiple attackers to compromise the same server.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Attribution

The threat actor behind the cwpdoor backdoor is unknown. The researchers do not have any information about the actor's motivation, victimology, or attribution. The backdoor is a custom-built backdoor, and it is not clear whether it is part of a larger campaign or a one-off attack.

The presence of the Ebury malware in the same archive as the cwpdoor backdoor raises concerns about the potential for multiple attackers to compromise the same server. The researchers do not know whether the two are related, and they suggest that different attackers may have planted them on the same server.

---

SOC Defense & Incident Response Playbook

1. Endpoint Quarantine & Host Remediation

• Immediately isolate compromised hosts from the local subnet via EDR network containment.
• Terminate suspicious parent-child process chains and remove unauthorized startup services and scheduled tasks.

2. Perimeter C2 Severance & Firewall Rules

• Block all outbound connections to identified C2 IP addresses and suspicious dynamic DNS domains.
• Implement strict DNS sinkholing to capture and redirect beaconing endpoints for forensic review.

3. Verification & Behavioral Audit Checklist

Remediation & Verification Checklist for cwpdoor Backdoor

• Check for suspicious socket activity using netstat or ss commands
• Verify the integrity of the cwpsrv file using ls and stat commands
• Monitor for unusual network activity using tcpdump or Wireshark tools
• Ensure that only authorized users have root access to the server
• Monitor web server access logs for any unusual activity
• Regularly update and patch the Control Web Panel (CWP) web server to prevent exploitation of known vulnerabilities
• Verify the integrity of the cwpsrv file using a secure hash function (e.g., SHA-256)
• Monitor for any changes to the cwpsrv file or its permissions
• Regularly scan the server for malware and backdoors using reputable security tools

Note: This checklist is not exhaustive and may need to be modified based on the specific environment and requirements.

---

Indicators of Compromise (IOCs)

No specific binary hashes were published in the authoritative advisory; hunt using behavioral telemetry and detection rules above.