What is FiveM malware / a FiveM backdoor?

FiveM malware refers to malicious Lua scripts embedded inside FiveM server resources, usually distributed through piracy sites or compromised downloads. These backdoors typically phone home to a C2 (command-and-control) server like cipher-panel.me or ketamin.cc to exfiltrate server data, steal player information, or allow remote code execution on the host machine.

How do I know if my FiveM server has been infected?

Common signs include unexplained server crashes, unknown resources appearing in your resources folder, unexpected outbound HTTP requests in logs, and player data being leaked. The most reliable way to check is to run a dedicated scanner like the Novonode FiveM Malware Scanner, which checks all your resources against 19 known malware signatures automatically.

What is cipher-panel and how does it relate to FiveM malware?

Cipher-panel (cipher-panel.me) is a known malware command-and-control panel widely used in FiveM backdoor campaigns. Infected resources silently send your server data -including player identifiers, server tokens, and configuration -to this domain. The Novonode scanner detects both plain-text and hex-encoded references to cipher-panel.

What is blum-panel and is it the same as cipher-panel?

Blum panel (also called blum-panel) is a known variant of cipher-panel -a command-and-control dashboard used to manage FiveM backdoor malware. Like cipher-panel, blum-panel is used to collect stolen server data, player identifiers, and tokens from infected FiveM resources. If you have seen references to blum-panel in your scripts or server logs, your server may be compromised. Run the Novonode FiveM Malware Scanner to check your resources for known cipher-panel and blum-panel signatures.

What is PerformHttpRequest and why is it flagged?

PerformHttpRequest is a legitimate FiveM built-in function used to make outbound HTTP requests, commonly used for Discord webhooks and license checks. It is flagged as "Network Activity" (not a direct threat) because it is also the primary method backdoors use to exfiltrate data. It should only be considered suspicious when found alongside critical or warning matches in the same file.

How does the FiveM Malware Scanner work?

The scanner runs a PowerShell script directly on your Windows FiveM server. You download a one-time .bat file, drop it in your resources folder, and double-click it. The script scans every Lua and JavaScript file against 19 malware signatures and sends the results back to this page automatically -no files are ever uploaded, and the results appear within seconds.

Is the FiveM Malware Scanner free?

Yes, the scanner is completely free to use. There is no account required and no file size limit. If malware is detected and you are hosted with Novonode, our team can manually remove it for a one-time $50 fee. If you are not yet hosted with Novonode, switching and using the code CIPHER2026 gives you 35% off recurring plus free malware removal.

Can I share my FiveM malware scan results?

Yes. After scanning, click "Share report" to copy a link that encodes the full scan results in the URL. Anyone with the link can view the complete report, including all matched signatures and file paths. This is useful for sharing with a hosting support team or a developer auditing your server.

What malware signatures does the scanner detect?

The scanner checks for 19 signatures including: known backdoor variable names (random_char, helpCode, helperServer), known C2 domains (cipher-panel.me, ketamin.cc) in both plain text and hex-encoded form, known malicious resource identifiers (Enchanced_Tabs, FiveTabs), hardcoded authentication tokens, dynamic Lua code execution (assert+load), shell execution (os.execute), JavaScript NUI obfuscation patterns, decompiled bytecode artifacts, and outbound HTTP calls.

Free Tool

FiveM Malware Scanner

Scan your server's resources folder for backdoors, C2 connections, and known malware signatures -runs directly on your Windows server via PowerShell.

49 signaturesruns on your serverresults appear here automatically

Download Scanner

Easiest

Download a one-time .bat file with your session pre-loaded. Drop it into your resources/ folder and double-click -done.

Run via PowerShell

Generate a one-time command to paste directly into PowerShell from inside your resources/ folder.

FiveM Hosting

Purchase a FiveM package today

Low-latency, NVMe-backed FiveM hosting with enterprise DDoS protection built for serious roleplay servers.

View FiveM Plans