Hackers backdoor Linux servers using trojanized CWP web server

A trojanized cwpsrv binary dubbed CWPdoor is being distributed to compromise Control Web Panel (CWP) servers; it remains passive until an attacker sends specially crafted encrypted HTTP headers (X-Ngx-Integrity-Data/Time/Sig) containing AES-256-CBC-encrypted commands verified by an RSA signature, and it suppresses access logs to hide activity. Researchers discovered the malicious updater script that replaces legitimate cwpsrv binaries, noted evidence of real victims and low antivirus detection, and recommend checking for the ngx_http_integrity_helper Unix socket, suspicious helper processes, X-Ngx-Integrity strings, replacing compromised binaries, upgrading, rotating credentials, and investigating hosts for additional malware.