Source: bleepingcomputer.com
A new Linux malware named CWPdoor is being distributed through a trojanized version of cwpsrv, the web server component of the Control Web Panel (CWP) server management interface. Attackers are leveraging this trojanized binary to backdoor Linux servers, gaining persistent unauthorized access. The malware targets systems running CWP, a widely used Linux server management panel. The attack involves replacing the legitimate cwpsrv binary with a malicious version that contains backdoor functionality. This supply chain-style attack vector makes detection difficult as the malware masquerades as a legitimate system component. Linux server administrators using CWP are advised to verify the integrity of their cwpsrv binaries and monitor for suspicious activity.
