CWPdoor Linux Trojan Hijacks Control Web Panel Servers via Fake cwpsrv Service

A freshly uncovered Linux malware, named CWPdoor, is slipping onto servers that operate the Control Web Panel (CWP) by posing as the panel's built‑in web server component, cwpsrv. Researchers say the hostile binary is being handed out as a trojanized copy of the legitimate service, granting attackers a lasting backdoor on infected machines.

The tainted cwpsrv file typically reaches victims through unofficial download mirrors or compromised update feeds that host Control Web Panel packages. When a system administrator swaps the genuine binary for the altered one, the server continues to run normally while quietly reaching out to remote command‑and‑control servers. Because the trojan keeps the original filename and path, many operators miss the swap during routine checks.

Analysis reveals that CWPdoor provides attackers with full root privileges, allowing them to run arbitrary commands, steal credentials, and move laterally to other devices on the network. The backdoor also carries modules for pulling additional payloads, launching DDoS attacks, and exfiltrating data, with its traffic encrypted, making network‑level detection difficult without dedicated signatures.

Control Web Panel is a widely used open‑source hosting control suite favored by small‑to‑medium web hosts and private server owners. Its broad deployment makes the new threat especially worrisome, as compromising a single panel can expose dozens of hosted sites and their databases. Early observations show several hosting setups have already seen unexplained traffic spikes and unauthorized file changes tied to a CWPdoor infection.

Security vendors and the CWP developer community have reacted swiftly. Advisories urge verification of the cwpsrv binary against official checksums, upgrading to the newest patched panel version, and scanning systems with reputable anti‑malware tools that include CWPdoor signatures. Administrators are also advised to tighten access controls, restrict root logins, and watch outbound connections for anomalous behavior.

Although the current fallout seems limited to Control Web Panel installations, the episode highlights a larger danger: supply‑chain attacks aimed at popular management utilities. Experts expect that more rigorous scrutiny of software distribution channels and stricter verification procedures will become commonplace recommendations for Linux server operators moving forward.