[cwpdoor]

November 6, 2026

• CWPdoor replaces the Control Web Panel server with a passive, log-suppressing backdoor. A fake updater swaps targeted cwpsrv versions, preserves timestamps, erases command history and accepts commands through signed, encrypted HTTP headers; triggering requests are removed from access logs. More than 340,000 Control Web Panel instances were internet-exposed during the past month, but that is not an infection count. One sample appeared alongside Ebury, although the relationship remains unknown. QiAnXin XLab and BleepingComputer · Threat Activity & Infrastructure

in ARTEX Operator Consoles Expose Near-Autonomous Cybercrime