Modified cwpsrv Binary in Control Web Panel Executes Commands via Unsigned X-Ngx-Integrity Headers

The installer cwpsrv_update.sh, captured June 29 and hosted at 136.0.141[.]71, requires root and swaps only the two listed cwpsrv versions before restoring original file timestamps. It creates a Unix socket named ngx_http_integrity_helper that the modified binary uses to receive and execute commands. A September 30 VirusTotal upload from Brazil containing the backdoor plus Ebury confirms in-the-wild deployment, yet no victim count exists.

Detection relies on three host checks: ss -axp showing the integrity socket, unexpected helper processes under cwpsrv, and strings output containing the X-Ngx-Integrity header names. The backdoored binary returned zero detections on VirusTotal at discovery. Root requirement implies prior compromise, so the backdoor functions as a persistence layer rather than an initial vector.

Ebury co-occurrence on the same archive does not establish shared operators; separate actors routinely reuse the same Brazilian infrastructure. No public contract or procurement record links this implant to state tooling, and technical artifacts remain consistent with criminal hosting-server monetization.

Next steps include restoring from the cwpsrv.prev-* backup if present, upgrading, rotating all CWP credentials, and full forensic review for additional implants. Continued monitoring of the 136.0.141[.]71 infrastructure for new payloads is warranted.