Tracking Growth Stocks, Tech Catalysts, and Market-Moving Equities

XLAB at $2.27: support $1.00, resistance $2.46; the chart, options flow and dark pools point in different directions.

Descriptive, non-directional summary of recent AI analyses.

Beschreibende, richtungsneutrale Zusammenfassung aktueller KI-Analysen.

XLAB at $2.28: support $0.99, resistance $2.41; the chart, options flow and dark pools point in different directions.

QiAnXin XLab says attackers swapped a core Control Web Panel component for a rebuilt copy that secretly runs commands sent in specially signed web requests and keeps them out of logs.

At a Glance Malware Family cwpdoor backdoor (trojanized cwpsrv 64-bit Linux ELF binary for versions 1.15.10 and 1.24.0) Threat Actor Unattributed (found alongside the Ebury SSH backdoor in one Brazilian incident; connection unconfirmed) Target / Victims Linux servers running Control Web Panel (1 confirmed victim upload in Brazil; 342,591 exposed CWP instances tracked globally) Delivery Vector

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server…

Introduction: A Backdoor Designed to Hide Its Own Activity A newly documented backdoor targeting Control Web Panel (CWP) infrastructure highlights a dangerous approach to server compromise: executing attacker-controlled commands through legitimate-looking web server functionality while deliberately avoiding access logs. Researchers from QiAnXin’s XLab have analyzed a malware variant called cwpdoor, which modifies the CWP web server component cwpsrv to process specially crafted requests.

XLab says CWPdoor is distributed through a trojanized CWP web server. The passive backdoor accepts signed, encrypted HTTP commands and suppresses access…

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.

Linux backdoors have been discovered that have been maliciously implanted into servers that are running Control Web Panel (CWP) via trojanized versions of its web server component, raising concerns about the security of hosting infrastructure in general. By crafted HTTP requests, attackers are able to execute commands remotely while concealing their activity from normal server access logs, a technique known as CWPdoor.  The malware was discovered by security researchers at XLab, the research division of QiAnXin Technology Group, on June 29 after capturing a malicious shell script. Scripted updates disguised themselves as legitimate software updates, replacing the original cwpsrv binary with a modified version that included a backdoor. Versions of Web Servers 1.15.10 and 1.24.0 were affected.  The CentOS Web Panel was previously known as the CentOS Web Panel, which is a free open-source web hosting management system for managing Linux servers and services, including email, DNS and databases. A web server component, known as CWPsrv, is responsible for handling requests to the management interface, making this compromise of particular concern to server administrators. During the month preceding the investigation, more than 340,000 CWP instances were exposed on the internet, according to XLab.  Even though public exposure does not guarantee infection, the number of attacks targeting this software indicates the potential reach of such attacks.  Malicious Update Script Conceals the Infection CWPdoor infections begin with scripts modifying the legitimate CCWPSRV executable with a trojanized version. In addition to installing the malicious binary, the script performs several other actions intended to make detection difficult. As a result, files and directories affected by the virus are restored to their original timestamps, temporary installation files are removed, and command history records are cleared. Through these methods, the replacement is less visible and routine administrative checks are less effective. The malware does not behave like a conventional backdoor that continually listens for incoming connections, but instead remains dormant until its operators issue a specially constructed HTTP request that triggers its operation. Consequently, ordinary network monitoring is unable to detect the threat due to its passive execution method.  The compromised web server continues to perform its legitimate functions while maintaining the ability to execute attacker-controlled commands when a valid request arrives. In particular, XLab described the malware as exceptionally stealthy, owing to its request validation mechanism and ability to interfere with server logging. By using these capabilities, a backdoor can be concealed within a trusted component of the server rather than appearing as a standalone process that appears to be suspicious.  Encrypted Requests and Log Manipulation Hide Attacker Activity  A malicious HTTP request carries three custom headers that are used by CWPdoor to control the execution of attacker commands. CWPdoor utilizes encryption and digital signature verification to ensure that attacker commands are executed in a controlled manner. X-Ngx-Integrity-Data contains an encrypted command; X-Ngx-Integrity-Time specifies a timestamp; and X-Ngx-Integrity-Sig contains an RSA signature.  The backdoor validates the RSA signature before executing a command. The malware decrypts the command once it has passed these checks and forwards it to the helper process for execution. Both commands and their output are protected using AES-256-CBC encryption. With the signature mechanism, attackers or external parties are also prevented from altering the encrypted payload or timestamp without invalidating the request.  As a result, the backdoor can only be activated when the request has been correctly signed, providing replay protection. CWPdoor has also been shown to suppress evidence of malicious activity in a significant way. It interferes with the logging module of the web server, preventing regular access log entries from displaying requests that trigger the backdoor. During routine security investigations, this can lead to administrators lacking crucial evidence.  VirusTotal Sample Points to Active Infections The analysis indicated that the CWPdoor sample had been uploaded to VirusTotal on September 30, along with the Ebury backdoor. Researchers discovered that the trojanized cwpsrv binary did not receive a single antivirus detection out of 63 security products tested. The discovery indicates that the malware has reached beyond testing and is already present on compromised systems.  It is unclear, however, whether CWPdoor and Ebury are operated by the same threat actors or whether they were installed independently on the same server. Ebury is an extensive Linux malware operation known for its backdoors and credential stealing capabilities. Since the malware was first identified in 2009, ESET reported that nearly 400,000 servers were compromised.  XLab Shares Detection and Mitigation Measures This malware has been identified by XLab. It is recommended that administrators inspect CWP servers for specific indicators associated with it. These include the ngx_http_integrity_helper Unix socket, unexpected helper processes launched by cwpsrv, and strings containing X-Ngx-Integrity. It is also recommended to check the integrity of the cwpsrv executable rather than relying on file timestamps, because the malicious installer may restore the values of the file timestamps to conceal unauthorized modifications, according to researchers.  A legitimate copy of the web server binary should be restored by administrators, the CWP must be updated to the newest version, and all control panel credentials must be rotated. Furthermore, the affected host should be subjected to an extensive security investigation to determine whether it has been infected with malware or unauthorized access. Because CWPdoor is capable of executing attacker-supplied commands, replacing the compromised binary may not be sufficient to secure the system. Server credentials, including privileged access accounts, should be treated as potentially vulnerable.

CWPdoor replaces Control Web Panel's web server after root access, enabling command execution through requests hidden from access logs.

A New Linux Server Threat Exploits Trust in Web Hosting Software Cybersecurity researchers at XLab have uncovered details of CWPdoor, a backdoor distributed through a trojanized version of Control Web Panel (CWP) web server software. The malware transforms compromised web servers into covert remote-access infrastructure, allowing attackers to communicate with infected systems through specially crafted HTTP requests while attempting to conceal their activities from routine security monitoring.

CWP es un panel gratuito para administrar servidores Linux de hosting, y lo que encontraron los investigadores de XLab —de QiAnXin— es una copia recompilada de su servidor web cwpsrv que se comporta normalmente hasta que llega un pedido con un timestamp y una firma válidos en headers cuyos nombres…

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.