CWPdoor, Lindnor & ARTEX: OTX Pulse Analysis — Linux Backdoors, Ransomware Tooling and Autonomous Intrusion Frameworks

The three OTX pulses published on 2026-11-05 reveal a diversified threat landscape spanning multiple operating systems, attack vectors, and adversary objectives.

The first pulse describes cwpdoor, a sophisticated passive backdoor embedded within the legitimate cwpsrv binary of Control Web Panel (CWP). This implant triggers only when it receives specially crafted HTTP requests containing cryptographic signatures, allowing remote command execution while suppressing logs. Brazil is currently listed as a targeted country.

The second pulse documents activity associated with the Hawkmoth adversary deploying the newly identified Lindnor backdoor during an intrusion involving Anubis ransomware against a U.S. organization. The attackers rapidly deployed thirteen executables within approximately one hour designed to terminate security tooling. Five publicly known vulnerable drivers were used in a BYOVD (Bring Your Own Vulnerable Driver) strategy to disable endpoint defenses. Persistence techniques included masquerading as Chrome and VMware components on Microsoft SQL Server systems and leveraging Safe Mode persistence.

The third pulse exposes infrastructure connected to ARTEX, an AI-driven autonomous penetration framework used in breaches affecting seven South Korean financial institutions. Approximately 66,000 individuals and 2,200 corporations were impacted. Investigators identified exposed infrastructure and AI model-routing components alongside indicators referencing vulnerabilities CVE-2025-5054 and CVE-2022-2588.

Collectively these pulses demonstrate how attackers are combining stealthy persistence mechanisms, aggressive security evasion, and automated attack tooling to compromise infrastructure across Linux hosting environments, Windows enterprise servers, and financial institutions.

Threat Actor / Malware Profile

CWPdoor (Linux Passive Backdoor)

Distribution Method

• Delivered via compromised Control Web Panel environments.
• Malicious code embedded directly into the legitimate cwpsrv binary.

Payload Behavior

• Executes remote commands on the infected Linux server.
• Suppresses web server logs to hide malicious activity.
• Maintains stealth by operating passively until triggered.

Command and Control

• Triggered through crafted HTTP requests containing cryptographic signatures.
• Indicator infrastructure observed hosting malicious cwpsrv builds at 136.0.141.71.

Persistence Mechanism

• Persistence achieved through modification of the legitimate cwpsrv service binary.

Anti-Analysis Techniques

• Passive listener architecture reduces network visibility.
• Log suppression hides exploitation activity.
• Signed request validation prevents accidental triggering.

Lindnor Backdoor (Hawkmoth / Anubis Campaign)

Distribution Method

• Deployed manually by attackers during an intrusion involving Anubis ransomware.

Payload Behavior

• Masquerades as legitimate Chrome or VMware components.
• Executes commands and facilitates follow-on payload deployment.

Security Evasion

• Attackers deployed at least thirteen executables within one hour to terminate security services.
• Five publicly known vulnerable drivers used in BYOVD attacks to disable endpoint protection.

Persistence Mechanism

• Safe Mode persistence mechanisms observed.
• Deployment on Microsoft SQL Server systems suggests targeting of high-value infrastructure.

ARTEX Autonomous Intrusion Framework

Distribution Method

• AI-assisted autonomous penetration framework used to identify and exploit vulnerabilities.

Payload Behavior

• Automates reconnaissance and exploitation.
• Infrastructure exposure revealed AI model routing components.

Infrastructure

• Exposed servers included 38.244.50.120 and 23.248.226.250.

Exploited Vulnerabilities

• CVE-2025-5054
• CVE-2022-2588

IOC Analysis

The pulses include multiple indicator types useful for detection and blocking.

File Hashes

• MD5, SHA1, and SHA256 hashes tied to Lindnor executables and cwpdoor binaries.
• These should be deployed to EDR blocklists immediately.

IPv4 Infrastructure

• 136.0.141.71 associated with malicious cwpsrv downloads.
• ARTEX infrastructure includes 38.244.50.120, 23.248.226.250, 202.95.14.60, 130.94.31.86, 149.88.85.20, and 118.107.47.11.

URLs

• http://136.0.141.71/static/cwpsrv_1.15.10
• http://136.0.141.71/static/cwpsrv_1.24.0
• http://136.0.141.71/static/cwpsrv_update.sh

SOC teams should ingest these indicators into SIEM watchlists, firewall blocklists, and EDR prevention policies. Network detection tools such as Zeek or Suricata can flag connections to these hosts, while threat intelligence platforms can enrich alerts with pulse metadata.

Detection Engineering

---
title: Suspicious CWP Binary Replacement Activity
id: 9b7f2c0e-3c1f-4e2b-9d35-6c1c2a3e1a11
status: experimental
description: Detects potential replacement or modification of cwpsrv binary associated with CWPdoor backdoor activity
author: Security Arsenal Detection Engineering
date: 2026/11/05
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type:
      - PATH
    name:
      - /usr/local/cwpsrv/bin/cwpsrv
      - /usr/local/cwpsrv/bin/cwpsrv_update.sh
  condition: selection
level: high
---
title: Suspicious Process Termination of Security Tools
id: 7a54c4de-9d3f-4a90-91e4-2f0e5a52b3d1
status: experimental
description: Detects mass termination of security tools consistent with ransomware security killers observed in Lindnor intrusions
author: Security Arsenal Detection Engineering
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - taskkill.exe
      - sc.exe
    CommandLine|contains:
      - stop
      - delete
      - terminate
  condition: selection
level: medium
---
title: Potential ARTEX Infrastructure Communication
id: 3d19d0a7-1c7b-4b3e-a4e2-5a0d1e9f21b2
status: experimental
description: Detects outbound network connections to infrastructure associated with ARTEX autonomous intrusion framework
author: Security Arsenal Detection Engineering
date: 2026/11/05
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp:
      - 38.244.50.120
      - 23.248.226.250
      - 202.95.14.60
      - 130.94.31.86
      - 149.88.85.20
      - 118.107.47.11
  condition: selection
level: high

let suspiciousIPs = dynamic([
"136.0.141.71",
"38.244.50.120",
"23.248.226.250",
"202.95.14.60",
"130.94.31.86",
"149.88.85.20",
"118.107.47.11"
]);
DeviceNetworkEvents
| where RemoteIP in (suspiciousIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc

# Hunt for suspicious network connections related to OTX indicators
$ips = @(
"136.0.141.71",
"38.244.50.120",
"23.248.226.250",
"202.95.14.60",
"130.94.31.86",
"149.88.85.20",
"118.107.47.11"
)

Get-NetTCPConnection | Where-Object {$ips -contains $_.RemoteAddress} |
Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess

# Check suspicious file hashes
$hashes = @(
"965aea67fb40de1bab5169ada993349f",
"d3f4e95113d49ab3991b45e457bda75b",
"e505d4ffa21cf494a5dc2d7c8f4f1236",
"eef8a950952696b018aa9c6da2f5d7ad"
)

Get-ChildItem C:\ -Recurse -ErrorAction SilentlyContinue |
ForEach-Object {
  $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
  if ($hashes -contains $h.ToLower()) { $_.FullName }
}

Response Priorities

Immediate

• Block all IPs and URLs listed in the pulses at perimeter firewalls and proxies.
• Deploy file hashes to EDR prevention policies.
• Search Linux systems for modified cwpsrv binaries.

Within 24 Hours

• Investigate systems communicating with ARTEX infrastructure.
• Review Windows event logs for mass security service termination events.
• Validate administrative credentials and service accounts if ransomware activity is suspected.

Within One Week

• Audit Control Web Panel installations for unauthorized modifications.
• Harden SQL Server hosts and restrict driver installation to trusted publishers.
• Patch systems vulnerable to CVE-2022-2588 and monitor exposure of management panels.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub