The Morning Dev

Only the news worth knowing

‹
 
  • AAPL 344.17 ▼ 1.53%
  • MSFT 535.93 ▼ 3.58%
  • NVDA 181.60 ▼ 9.26%
  • GOOGL 282.57 ▼ 2.20%
  • AMZN 260.21 ▼ 2.19%
  • META 605.08 ▼ 3.96%
  • TSLA 343.69 ▼ 10.77%
  • AVGO 291.53 ▼ 10.43%
  • TSM 353.10 ▼ 10.78%
  • ORCL 115.16 ▼ 6.93%
  • AMD 404.40 ▼ 17.26%
  • NFLX 65.56 ▼ 1.25%
  • CRM 222.41 ▼ 2.07%
  • ADBE 246.44 ▼ 0.82%
  • INTC 52.25 ▼ 10.33%
  • IBM 247.11 ▼ 2.84%
  • PLTR 154.99 ▼ 9.73%
  • SNOW 269.54 ▼ 7.25%
  • NET 244.51 ▼ 8.28%
  • SAP 243.53 ▲ 1.45%

Security · High impactFan score 48 · Tier B3 sources

Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

The Hacker News · By info@thehackernews.com (The Hacker News) ·

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those…

Read the full story at thehackernews.com ↗

The Brief

  • CERT-In says the AI-assisted threat actor Crafty Falcon is targeting banking, financial services and insurance organizations in India.
  • A trojanized cwpsrv web server, the component behind Control Web Panel, is used to distribute the CWPdoor Linux backdoor.
  • QiAnXin's XLab reports the backdoor executes commands sent via web requests without leaving logs, and a backdoored ARTEX is reported to expose 62 consoles to root access.

Why it matters

Servers running Control Web Panel may carry a backdoor that gives attackers command execution without leaving logs, so affected hosts can be compromised without obvious traces.

Who’s affected

  • Admins running Control Web Panel (CWP) on Linux hosting servers
  • Organizations in India's banking, financial services and insurance sectors targeted by Crafty Falcon

What to do

  1. Check Linux servers running Control Web Panel for a trojanized cwpsrv and the CWPdoor backdoor
  • #security
  • #malware
  • #backdoor
  • #linux
  • #supply-chain
  • #control-web-panel

Timeline

  1. CERT-In discloses AI-assisted attacks by Crafty Falcon against BFSI organizations in India

  2. CWPdoor Linux malware reported as distributed via trojanized cwpsrv

  3. The Hacker News

    CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

  4. BleepingComputer

    Hackers backdoor Linux servers using trojanized CWP web server

  5. The Hacker News

    Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

Full coverage · 3 sources

How do you feel about this?

0 Comments

    More in Security

    Security · High impact

    AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research

    An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million. The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on SecurityWeek .

    SecurityWeek · Eduard Kovacs · · 3 sources · 💬 353

    Security · High impact

    Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services

    Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data…

    The Hacker News · info@thehackernews.com (The Hacker News) · · 2 sources

    Security · High impact

    Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

    Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on…

    The Hacker News · info@thehackernews.com (The Hacker News) · · 2 sources