QiAnXin XLab has documented cwpdoor, a Control Web Panel backdoor built into cwpsrv, the web server that runs the panel. Once an attacker already has root, the rebuilt binary executes commands sent in signed web requests and keeps those requests out of the access log.
