Ebury trojan on all of my CWP servers

Hello,

Today I was informed by our national domain registry that couple of my ip addresses are doing some malicious activities. Also they suspected that it is "Ebury Linux SSH rootkit/backdoor trojan".

And really after malware scan of all my servers (5 servers), everyone was having this trojan. Any hint on how can those trojans get in to the system, and how to prevent future problems?

Yep got a notification to that this was the case. Would love to know whats going on here.

What are you using for your malware scan? We got the same notice but our scans are coming up clean.

I found trojan on all servers. I went to Security/Security Center/Malware Scan and then selected Custom scan from / (root) folder. It took a while but Trojan was found. Other things was also found in emails but it's normal Unix.Dropper.Ebury-9906999-0
 was found in usr/lib64/libkeystats.so. I have no idea how it got there. All of my server have different password generated at random.org (for example dr3Zd^VQnyy2q^w3). SSH port is not default.

My server admin said they saw rumblings about other CWP servers having this issue starting on March 17th -20th. Maybe the March 20th update was a patch?

Im running the scans now, will probably take a while. What OS were you running on the infected machines? One of mine was Centos 8 and the other was AlmaLinux 8.5. Also were you on a fully updated CWP?

Are you planning on re-building from scratch? From what I read thats the only definite solution.

The same thing happened to me. 2 servers with CentOS 7 and CWP 7 were infected. I did a quick analysis and it turned out that the infection happened more than 11 months ago for sure. Another thing I found out is that the server was not infected 3 years ago. I learned this from the backups I have for these 2 servers. So, the infection did not happen on March 17-20... Keep this in mind.

just did a complete scan. Took 108 minutes scanning almost half a million files. I dont have it

Ok, I'am infected too...
I am scaning now with clam, will clam clean it?

Thx!

Once the system is compromised, it is unknown which backdoors are open.

so only way to get rid it is clean os install?

Maybe. The first thing you can do is change the SSH port and restrict access to SSH login for all users on the system to trusted IP addresses. Change the passwords for absolutely all users. This does not solve the problem since CWP is compromised and requests can be executed as root from there, but somehow it ensures that the server is not used for botnets - DDoS, email spam, etc. As I said, the infection through CWP was long ago. Personally, I think one of my servers was infected minutes before 03.09.2021, 03:46:34, because the logs before that are missing, and it has been online since 2020. I also restored backups and the infection existed 2-3 years ago. Even if the server is cleaned, as long as the vulnerability in CWP exists, it is still under threat. Personally, I will wait for the CWP bug to be fixed and then reinstall the server with the new CWP panel.

By the way, which hosting provider do you use? My servers are with hetzner.com.

By the way, which hosting provider do you use? My servers are with hetzner.com.

Hetzner as well!

Maybe. The first thing you can do is change the SSH port and restrict access to SSH login for all users on the system to trusted IP addresses. Change the passwords for absolutely all users. This does not solve the problem since CWP is compromised and requests can be executed as root from there, but somehow it ensures that the server is not used for botnets - DDoS, email spam, etc. As I said, the infection through CWP was long ago. Personally, I think one of my servers was infected minutes before 03.09.2021, 03:46:34, because the logs before that are missing, and it has been online since 2020. I also restored backups and the infection existed 2-3 years ago. Even if the server is cleaned, as long as the vulnerability in CWP exists, it is still under threat. Personally, I will wait for the CWP bug to be fixed and then reinstall the server with the new CWP panel.

thank you
but, can you please tell me which way I can be 100% sure that malware exists?
I'm asking this because many tess found on internet shows that my system is not infected.
Your test only shows that it is. And if I run it on other server (which is not connected to my original in any way), there too it shows positive

thank you
but, can you please tell me which way I can be 100% sure that malware exists?
I'm asking this because many tess found on internet shows that my system is not infected.
Your test only shows that it is. And if I run it on other server (which is not connected to my original in any way), there too it shows positive

Check if you have /usr/lib64/libkeystats.so file in your system. If you do you're infected. I would say it's safe to bet that the majority of CWP users are infected and don't know it.

As top20 said most likely the vulnerability with CWP is still open so cleaning out the server, re-installing the OS and then putting back CWP will probably just end up with the same issue until it's patched.