A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.

CWPdoor acts as a passive backdoor that sits dormant on the compromised system until the attacker sends a specially crafted request.

Researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, describe CWPdoor as “exceptionally stealthy” due to its passive triggering and log suppression feature.