CWPdoor acts as a passive backdoor that sits dormant on the compromised system until the attacker sends a specially crafted request. Researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, describe CWPdoor as "exceptionally stealthy" due to its passive triggering and log suppression feature. CWP, formerly known as CentOS Web Panel, is an open-source web hosting administration solution similar to cPanel and Plesk that allows users to manage web servers and services such as email, DNS, and databases.
According to XLab, more than 340,000 CWP instances have been exposed on the public web over the past month. The researchers discovered the CWPdoor malware on June 29 after capturing a script posing as an updater that replaced the legitimate 'cwpsrv' binary with a malicious version.
