AquaShell

AquaShell is a lightweight Python backdoor used to maintain persistence on compromised Cisco AsyncOS appliances, particularly Cisco Secure Email Gateway and Cisco Secure Email and Web Manager systems. It has been associated with exploitation of CVE-2025-20393 by the China-nexus threat actor UAT-9686, which Cisco Talos assessed with moderate confidence as an advanced persistent threat. The malware has been observed as a post-exploitation implant on a limited subset of internet-exposed appliances with Spam Quarantine enabled under non-standard configurations.

AquaShell functions as a covert command-execution backdoor. It is capable of receiving encoded commands through unauthenticated HTTP POST requests and executing them in the system shell, providing attackers with persistent remote access and flexible post-compromise control. Reporting also describes it as embedded into AsyncOS web components to blend with legitimate appliance functionality. In observed campaigns, AquaShell was deployed alongside additional tooling including AquaTunnel or ReverseSSH for reverse tunneling, Chisel for traffic proxying and pivoting, and AquaPurge for log clearing and anti-forensics.

The malware’s operational role is persistence and post-exploitation rather than initial compromise. Initial access in the documented campaign was achieved through exploitation of a critical AsyncOS remote command execution vulnerability, after which AquaShell was installed to preserve access and support follow-on operations. The broader activity aligns with long-term espionage-oriented tradecraft focused on stealth, durable access to edge infrastructure, and concealment of attacker activity.