Loading story…
Researchers disclosed a stealthy Linux backdoor, tracked as Linux/Cdorked.A, that replaced the Apache httpd binary on cPanel-hosted servers and intermittently injected malicious 302 redirects into web traffic. Victims were sent to fast-changing attacker-controlled domains that delivered malware, spam and adult-content redirects, and in many cases the Blackhole Exploit Kit using known Java and PDF exploits. Investigators linked the activity to a decline in earlier DarkLeech-style infections, suggesting the operators may have shifted from malicious Apache modules to a harder-to-detect binary replacement.
The malware was designed to evade administrators by storing configuration in shared memory, avoiding normal Apache logs, preserving file timestamps, and in some cases marking the trojanized binary immutable. Analysts said the campaign appeared to target Apache deployments installed through cPanel, not necessarily because cPanel itself was vulnerable, but because its Apache installation and logging model made compromise harder to spot. The initial root-level intrusion vector remained unconfirmed, with suspected paths including SSH brute-force attacks, phishing, or stolen credentials, while defenders were advised to use file-integrity monitoring, anti-malware scanning, and checks for artifacts such as the string open_tty in the Apache directory to identify tampered binaries.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
ESET clarified that Linux/Cdorked.A does leave a disk artifact: a modified Apache httpd binary, even though its operational data and payload reside in shared memory. The clarification also noted that rebooting removes the in-memory payload and that file-integrity monitoring or anti-malware scanning can detect the altered binary.
On April 26, 2013, public reporting described a shift from Darkleech-style malicious Apache modules to trojanized Apache httpd binaries on cPanel-based servers. The disclosures detailed stealth features, intermittent malicious redirects, and ESET's classification of the malware as Linux/Cdorked.A.
Cisco TRAC reported that it first observed the Linux/CDorked Apache backdoor on March 4, 2013. The emergence coincided with a decline in DarkLeech infections, suggesting a possible connection between the campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceblogs.cisco.com
Open sourcearstechnica.com
Open sourceblog.sucuri.net
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Aug 15, 2026
WebPros cPanel disclosed and patched a critical authentication bypass flaw in **cPanel & WHM** and **WP Squared**, now tracked as `CVE-2026-41940` with a **CVSS 9.8** score. The bug affects all supported cPanel & WHM versions after `11.40` prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a **CRLF injection** in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart `cpsrvd`, and investigate session files and logs for signs of compromise. Multiple sources reported the flaw was **actively exploited in the wild** before patches were issued, with hosting providers such as **Namecheap** and **KnownHost** taking emergency action by restricting access to management ports like `2083` and `2087` while deploying fixes. **CISA** added `CVE-2026-41940` to its **Known Exploited Vulnerabilities** catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
Sep 3, 2026
Researchers documented **Linux/SSHDoor.A**, a trojanized OpenSSH daemon that steals usernames and passwords from compromised Linux servers while giving attackers covert persistent access. The malware exfiltrates server and credential data over HTTP after encrypting it with an embedded **1024-bit RSA** key and Base64-encoding the result, and it can preserve access through a hardcoded password or bundled SSH key, with override options read from `/var/run/.options`. ESET linked the activity to infrastructure including **`openssh.info`** and **`linuxrepository.org`**, which at the time resolved to **`82.221.99.69`**, and a later sample shared publicly was detected by multiple antivirus engines as an SSH backdoor. The SSH backdoor was also observed alongside **Linux/Chapro.A**, a malicious Apache module used to inject iframes into web traffic, delivering a Java exploit for **`CVE-2012-1723`** and ultimately a **Zeus/Zbot** payload to Windows victims. In later research, ESET expanded the picture beyond SSHDoor, identifying **21** undocumented or underdocumented Linux malware families built from trojanized OpenSSH binaries; **18** stole credentials and **17** provided stealth backdoor access. The findings showed that OpenSSH backdoors remained an active and diverse threat on Linux servers, ranging from simple credential theft to more advanced families using encrypted HTTP, raw TCP, or DNS for command and control.
Aug 15, 2026