Attackers are replacing cwpsrv, the web server behind the free hosting panel Control Web Panel (CWP), with a backdoored copy, according to researchers at XLab, part of QiAnXin. The backdoor, named cwpdoor, stays dormant until it receives a signed request, then runs the attacker’s command and keeps that request out of the access logs. XLab … Continue reading CWPdoor Replaces Control Web Panel’s Web Server and Hides Attack Commands From Logs