Hackers backdoor Linux servers via trojanized CWP panel
Attackers are installing a backdoor on Linux servers through a trojanized version of CWP (Control Web Panel), a web hosting control panel. The attacks were reported by BleepingComputer; the sources give no fix information. Administrators should verify the origin and integrity of panel installations.
What happened
Attackers are distributing a trojanized version of CWP (Control Web Panel), a Linux server management panel. The tampered version installs a hidden backdoor on servers. The attacks were reported by BleepingComputer.
Why it matters
Compromised servers fall under attacker control, with risk of data theft and misuse of infrastructure. Companies that host websites or manage Linux servers with CWP are the direct targets.
What to do
Verify that installed CWP was obtained from the official source and confirm the integrity of installation files. Review CWP servers for unknown access and accounts.
For the technical team
- Affected
- Control Web Panel CWP (Control Web Panel), painel de controle de hospedagem para servidores Linux · Linux servers with CWP (Control Web Panel) installed. Specific versions not stated in the sources.
- Exploitation
- Attacks reported by BleepingComputer. The source does not mention a public PoC, KEV listing, or wide-scale exploitation.
- Fix
- Not stated in the sources.
- Vector
- Software supply chain attack: a trojanized version of CWP (Control Web Panel), a hosting control panel for Linux servers, is used to install a backdoor. The distribution method of the tampered version is not stated in the source.
- More details
- The only available source is a BleepingComputer post. Technical details such as indicators of compromise, attack chain, who discovered it, and timeline are not in the source.
Timeline
BleepingComputer reports Linux servers backdoored via trojanized CWP.
Sources 1 source
- @BleepinComputer @BleepinComputer
