BleepingComputer reported on 5 November 2026 that researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, described a Linux malware called CWPdoor distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.

According to BleepingComputer's report of XLab's findings, CWPdoor is a passive backdoor that sits dormant until the attacker sends a specially crafted request, and XLab describes it as "exceptionally stealthy" because of its passive triggering and log suppression.

BleepingComputer says XLab discovered the malware on 29 June after capturing a script posing as an updater that replaced the legitimate cwpsrv binary with a malicious version; the script replaces cwpsrv versions 1.15.10 and 1.24.0 and takes steps to hide the switch, including restoring timestamps, deleting temporary files and wiping the command-history log.

According to the report, operators activate the backdoor with encrypted HTTP headers (X-Ngx-Integrity-Data, X-Ngx-Integrity-Time and X-Ngx-Integrity-Sig), using AES-256-CBC encryption and an RSA signature check with a ±300-second timestamp window for replay protection, and the backdoor keeps the triggering request out of access logs.

BleepingComputer says that after finding the initial infection script, XLab saw CWPdoor uploaded to VirusTotal on 30 September in an archive that also included the Ebury backdoor, with the malicious cwpsrv file showing zero detections, which XLab said indicated real victims already exist; XLab said the connection between Ebury and CWPdoor remains unclear.

According to XLab as reported by BleepingComputer, more than 340,000 CWP instances have been exposed on the public web over the past month. (source: BleepingComputer)

Correction (06 Nov 2026): primary source swapped to BleepingComputer because XLab's post could not be read this pass; removed the download IP and other details BleepingComputer does not state. (source: BleepingComputer)