Trojanized CWP web server reportedly spreads CWPdoor Linux backdoor
BleepingComputer reports that a new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel management interface.
Written by a model from the sources below. Verify against them.
- Kind
- Malicious package
- Vendor
- Control Web Panel
- Product
- cwpsrv
- Status
- Reported, not confirmed
- First seen
Summary
BleepingComputer reports that a new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel management interface. The report describes the backdoor as hitting Linux servers, and the item does not say how many systems are affected.
What to do
Verify the cwpsrv binary against a known-good copy from the vendor
Update Control Web Panel to the latest release
Hunt for CWPdoor indicators on servers running CWP
Restrict access to the CWP management interface
Timeline
- Made public by BleepingComputer
- First seen by cve.now
Evidence 2
- PressBleepingComputer
“A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.”
- SocialMastodon
“QiAnXin XLab reports CWPdoor, a backdoor built into the cwpsrv binary used by Linux Control Web Panel.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-56bfa02295
Has Control Web Panel confirmed it?
BleepingComputer and Mastodon report it. No statement from Control Web Panel has reached cve.now yet.Source: BleepingComputer, Mastodon
What should Control Web Panel users do?
Verify the cwpsrv binary against a known-good copy from the vendor. Update Control Web Panel to the latest release. Hunt for CWPdoor indicators on servers running CWP. Restrict access to the CWP management interface.