Hackers backdoor Linux servers using trojanized CWP web server

According to a report published by BleepingComputer, a new strain of Linux malware dubbed CWPdoor is being deployed via a trojanized version of cwpsrv, the web server that underpins the Control Web Panel (CWP) server management interface. The report states that unknown threat actors have replaced the legitimate cwpsrv binary with a compromised variant, which delivers the CWPdoor malware to Linux servers. The malware is designed to provide unauthorized remote access to compromised systems, potentially enabling full system compromise and risk to hosted websites and data. The exact distribution vector and the scale of the infection campaign are not fully detailed in the available reports. Researchers have assigned the name CWPdoor, but specific threat actor attribution has not yet been identified. The report notes that updating Control Web Panel to the latest official version, verifying binary integrity, and monitoring for unauthorized cwpsrv processes are recommended mitigation steps.