Hackers Hide Linux Backdoor in Control Web Panel to Execute Commands Without Logs

Cybersecurity researchers have discovered a previously identified backdoor hidden inside the web server component of Control Web Panel, a popular platform used to manage Linux hosting environments.

The malware, named cwpdoor by researchers at QiAnXin’s XLab, allows attackers to execute commands remotely through specially crafted web requests without leaving the usual records in server access logs.

Investigators say the backdoor is particularly concerning because it modifies the legitimate web server software rather than operating as a completely separate malicious application.

The compromised component continues behaving like normal server software until it receives a request containing specially structured headers with a valid timestamp and digital signature.

Once the request is accepted, the hidden functionality executes commands supplied by the attacker.

Researchers discovered that the malicious installation process uses a shell script disguised as a software update.

The installer replaces the original Control Web Panel server binary with a modified version containing the backdoor. It was designed to target specific versions of the cwpsrv component, including versions 1.15.10 and 1.24.0.

Another concerning feature is the malware’s ability to restore the original file timestamps after replacing the server component. This makes basic file inspection more difficult because standard tools may indicate that the file has not been modified.

The researchers also reported that the installation process requires root-level access, meaning attackers must already have obtained significant control over the targeted server before deploying the backdoor.

An archive containing a sample of the malware was uploaded to VirusTotal from Brazil on September 30, suggesting that real-world infections may already exist.

XLab has published several technical checks that administrators can use to investigate potential infections, including examining unusual processes, Unix sockets, and suspicious integrity-related strings inside the server binary.

The discovery highlights the importance of monitoring Linux hosting environments, securing administrative access, and investigating unexpected changes to critical server components.

Hosting providers should pay particular attention to privileged access, software integrity, and suspicious activity that may not appear in traditional access logs.