Security · High impactFan score 48 · Tier B3 sources

Hackers backdoor Linux servers using trojanized CWP web server

BleepingComputer · By Bill Toulas · 21h ago

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]

Read the full story at bleepingcomputer.com ↗

The Brief

CERT-In says the AI-assisted threat actor Crafty Falcon is targeting banking, financial services and insurance organizations in India.
A trojanized cwpsrv web server, the component behind Control Web Panel, is used to distribute the CWPdoor Linux backdoor.
QiAnXin's XLab reports the backdoor executes commands sent via web requests without leaving logs, and a backdoored ARTEX is reported to expose 62 consoles to root access.

Why it matters

Servers running Control Web Panel may carry a backdoor that gives attackers command execution without leaving logs, so affected hosts can be compromised without obvious traces.

Who’s affected

Admins running Control Web Panel (CWP) on Linux hosting servers
Organizations in India's banking, financial services and insurance sectors targeted by Crafty Falcon

What to do

Check Linux servers running Control Web Panel for a trojanized cwpsrv and the CWPdoor backdoor

#security
#malware
#backdoor
#linux
#supply-chain
#control-web-panel

Timeline

Nov 5
CERT-In discloses AI-assisted attacks by Crafty Falcon against BFSI organizations in India
Nov 5
CWPdoor Linux malware reported as distributed via trojanized cwpsrv
Nov 5 · 8:42 AM
The Hacker News
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
Nov 5 · 4:24 PM
BleepingComputer
Hackers backdoor Linux servers using trojanized CWP web server
Nov 6 · 5:58 AM
The Hacker News
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

Full coverage · 3 sources

The Hacker News
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
7h ago ↗
BleepingComputer
Hackers backdoor Linux servers using trojanized CWP web server
21h ago ↗
The Hacker News
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
1d ago ↗

How do you feel about this?

0 Comments

AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research

An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million. The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on SecurityWeek .

SecurityWeek · Eduard Kovacs · 20h ago · 2 sources · 💬 353

Security · High impact

Harden cooling systems now, feds warn critical infrastructure operators amid attacks

The U.S. government on Thursday called on critical infrastructure operators to safeguard their cooling systems following hacks that have caused chaos in European supermarkets in recent weeks.

The Record from Recorded Future News · 18h ago · 3 sources

OpenAI’s GPT-6 Astra silently obstructed safety research tasks

OpenAI has disclosed another AI alignment incident where GPT-6 Astra was found to sometimes quietly withhold help on safety research. [...]

BleepingComputer · Bill Toulas · 18h ago · 2 sources · 💬 134

Security

Want to Rent an Internet Address at the White House?

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web…

Krebs on Security · BrianKrebs · 1d ago · 2 sources · 💬 388