The Morning Dev

Only the news worth knowing

‹
 
  • AAPL 344.17 ▼ 1.53%
  • MSFT 535.93 ▼ 3.58%
  • NVDA 181.60 ▼ 9.26%
  • GOOGL 282.57 ▼ 2.20%
  • AMZN 260.21 ▼ 2.19%
  • META 605.08 ▼ 3.96%
  • TSLA 343.69 ▼ 10.77%
  • AVGO 291.53 ▼ 10.43%
  • TSM 353.10 ▼ 10.78%
  • ORCL 115.16 ▼ 6.93%
  • AMD 404.40 ▼ 17.26%
  • NFLX 65.56 ▼ 1.25%
  • CRM 222.41 ▼ 2.07%
  • ADBE 246.44 ▼ 0.82%
  • INTC 52.25 ▼ 10.33%
  • IBM 247.11 ▼ 2.84%
  • PLTR 154.99 ▼ 9.73%
  • SNOW 269.54 ▼ 7.25%
  • NET 244.51 ▼ 8.28%
  • SAP 243.53 ▲ 1.45%
B48/100

Supply-chain attack · high

Backdoored ARTEX/CWP-style server images

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Servers running trojanized cwpsrv from Control Web Panel

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover · Supply chain

The Brief

  • CERT-In says the AI-assisted threat actor Crafty Falcon is targeting banking, financial services and insurance organizations in India.
  • A trojanized cwpsrv web server, the component behind Control Web Panel, is used to distribute the CWPdoor Linux backdoor.
  • QiAnXin's XLab reports the backdoor executes commands sent via web requests without leaving logs, and a backdoored ARTEX is reported to expose 62 consoles to root access.

Why it matters

Servers running Control Web Panel may carry a backdoor that gives attackers command execution without leaving logs, so affected hosts can be compromised without obvious traces.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsJudgment: CWP is a Linux hosting control panel run by sysadmins and hosting ops teams.
NoCore infrastructureJudgment: a single hosting control panel's web server, not core infrastructure like OpenSSH or the kernel.
NoPopular toolJudgment: CWP is a niche hosting panel, not a mainstream developer tool or framework.
YesExploited in the wildBleepingComputer: CWPdoor malware is being distributed via trojanized cwpsrv, an active campaign.
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept was published.
NoRemote, no loginSources say the backdoor runs commands sent via web requests but do not state that no credentials are needed.
YesFull takeoverThe Hacker News headline: backdoored ARTEX exposes 62 consoles to root access.
NoSecrets exposedNo source reports credentials, keys, configs or customer data being stolen or exposed.
YesSupply chainThe Hacker News: backdoor hidden in CWP's web server; BleepingComputer: distributed through trojanized cwpsrv build of a legitimate project.
NoNo fix yetNo source states whether a patched version of CWP or cwpsrv is available.

Timeline

  1. CERT-In discloses AI-assisted attacks by Crafty Falcon against BFSI organizations in India

  2. CWPdoor Linux malware reported as distributed via trojanized cwpsrv

  3. The Hacker News

    CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

  4. BleepingComputer

    Hackers backdoor Linux servers using trojanized CWP web server

  5. The Hacker News

    Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

Full coverage · 3 sources

First seen · 3 sources · Full story page · How tiers are decided