CWPdoor: The Invisible Backdoor Living Inside Control Web Panel

A sophisticated passive backdoor named cwpdoor has been discovered targeting Control Web Panel (CWP), a free open-source server management control panel for Linux. The malware embeds malicious code directly into the legitimate cwpsrv binary and is triggered only by specially crafted HTTP requests containing cryptographic signatures. It executes commands remotely while suppressing access logs, leaving no forensic traces. With over 340,000 CWP instances exposed to the internet, the threat surface is substantial. First observed in June 2026 with deployment infrastructure at 136.0.141.71, the backdoor achieved zero detection rates across security vendors. A real-world victim was identified in Brazil in September 2026. The backdoor uses RSA signature verification and AES-256-CBC encryption for command and control communications through Unix domain sockets, making detection extremely difficult through conventional means.

• Kothamine malware uses Tailscale's tailcat to evade network detectionMalware2026-09-26
• Q1 2026 Malware Statistics Report for Linux SSH ServersMalware2026-04-14