CybersecurityUpdated November 6

CWPdoor hides in a trojanized CWP server.

Control Web Panel manages Linux hosting servers, but CWPdoor's hiding place is the web server behind the panel. The malware is being distributed through a trojanized version of that server. QiAnXin's XLab researchers, as reported by The Hacker News, found that the backdoor lets attackers execute commands sent through web requests that never appear in the server's access logs. But this command channel isn't the way in: installing the backdoor requires root access. The researchers say attackers must already control the server, so CWPdoor explains how they can run commands without an access-log record—not how they got in to begin with.

2 publishers2 reports

Coverage started November 5