Threat Overview
QiAnXin XLab identified a modified cwpsrv web-server executable containing a command-execution backdoor. Researchers captured an installer disguised as a version update; installation requires existing root access. Malicious requests can be excluded from the compromised web server access logs, limiting HTTP-based visibility.
References
– 2026-11-06: https://thehackernews.com/
– 2026-11-06: The Hacker News, “Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs”
Impacted Systems
Control Web Panel (CWP) self-managed Linux hosting servers running cwpsrv. Researcher-observed installer targets cwpsrv 1.15.10 and 1.24.0; this is not a complete vendor affected-version list. Prerequisite: attacker already has root. Internet-facing CWP administration may increase attack surface; no verified first-safe version or official patch build was established.
Why this matters
Recent verified reporting indicates a potentially consequential enterprise threat. Layered Sentinel hunting can surface related activity where supporting logs are ingested.
Exploitation Status
Researcher-confirmed malware and installer; an archive uploaded from Brazil suggests possible victims, but number and initial access vector are unconfirmed.
What this hunt looks for
No customer-specific Sentinel telemetry was reviewed during report preparation. The following queries are designed to assess authentication, system and endpoint process behavior, network traffic, and persistence where those data sources are ingested.
Required logs
This is a prepared hunt package, not a completed customer workspace investigation. Conclusions are limited to the tables and retention actually ingested into Microsoft Sentinel. Absence of matching activity cannot establish absence of compromise on unmonitored hosts or in non-ingested logs.
CWP service update or replacement indications
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("cwpsrv","cwpdoor","Control Web Panel")
| where SyslogMessage has_any ("update","install","restart","replace","binary")
| project TimeGenerated,Computer,ProcessName,SyslogMessageCWP web server launching shell tools
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName has "cwpsrv"
| where FileName in~ ("sh","bash","curl","wget","python3","nc","socat")
| project TimeGenerated,DeviceName,FileName,ProcessCommandLine,InitiatingProcessFileNameCWP executable file modifications
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName has "cwpsrv"
| project TimeGenerated,DeviceName,ActionType,FolderPath,FileName,InitiatingProcessFileNameCWP process outbound communications
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName has "cwpsrv"
| project TimeGenerated,DeviceName,RemoteIP,RemotePort,InitiatingProcessCommandLine,ActionTypeUnusual inbound requests to web administration ports
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort in (2030,2031)
| summarize Requests=count(),Sources=dcount(SourceIP),SampleURLs=make_set(RequestURL,5) by bin(TimeGenerated,1h),DestinationIP
| order by Requests descCWP related service and privilege changes in Linux Syslog
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("cwpsrv","cwp") and SyslogMessage has_any ("sudo","root","systemd","service","permission")
| project TimeGenerated,Computer,ProcessName,SyslogMessageNew remote peers for CWP-hosted web services
let Base=DeviceNetworkEvents | where TimeGenerated between (ago(30d)..ago(2d)) and InitiatingProcessFileName has "cwpsrv" | summarize by DeviceId,RemoteIP;
DeviceNetworkEvents | where TimeGenerated >= ago(2d) and InitiatingProcessFileName has "cwpsrv" | join kind=leftanti Base on DeviceId,RemoteIP | project TimeGenerated,DeviceName,RemoteIP,RemotePort,ActionTypeDetection Notes
The highest-value first pass is the initial query when the required data is ingested; correlate with asset inventory before attributing activity. Generic process, network, and administrative events can reflect legitimate operations. DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents require endpoint telemetry ingested into Sentinel; Syslog requires forwarding; CommonSecurityLog requires suitable network or HTTP fields. A missing table or absent process command line is a visibility gap, not a negative result. No query can establish patch level without separate inventory. Backdoored cwpsrv may suppress its own access logs, so network-device or endpoint events are more reliable than host HTTP logs.
