Loading malware…
AquaTunnel is a Go-based reverse SSH backdoor derived from the open-source ReverseSSH project. It is used after successful compromise to establish outbound reverse SSH tunnels from a victim system to attacker-controlled infrastructure, providing persistent remote access even when the compromised host is located behind firewalls or network address translation. In observed intrusions, AquaTunnel functioned as a post-compromise access and tunneling implant that enabled operators to maintain control of compromised appliances and support internal pivoting.
AquaTunnel has been observed in campaigns targeting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS, particularly in exploitation associated with CVE-2025-20393. Cisco Talos linked this activity with moderate confidence to the Chinese-nexus threat actor UAT-9686. Reporting also notes overlaps in tooling and tradecraft with other China-aligned groups, including APT41 and UNC5174. In these operations, AquaTunnel was deployed alongside the Python-based AquaShell backdoor, the Chisel tunneling utility, and the AquaPurge log-clearing tool, indicating a toolkit designed for persistence, covert remote access, pivoting, and anti-forensics.
The malware is compiled as an ELF binary and is intended for Linux-based appliance environments. Its primary role is to create a durable encrypted channel for unauthorized remote administration of compromised edge devices and security appliances after initial access has already been achieved through exploitation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-20393 (CVSS skóre 10,0) Kritická zero-day zraniteľnosť zariadení Cisco SEG a Cisco SEWM je aktívna, keď má zariadenie povolenú a do internetu vystavenú funkcionalitu Spam Quarantine. Zraniteľnosť sa nachádza v operačnom systéme Cisco AsyncOS a vzdialený neautentifikovaný útočník by ju mohol zneužiť na vzdialené vykonanie systémových príkazov s oprávneniami root. Zraniteľnosť je aktívne zneužívaná minimálne od konca novembra 2025. | ...pri nasadzovaní perzistentných zadných dvierok AquaShell, nástrojov pre vytváranie reverzných tunelov SSH AquaTunnel...
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...pri nasadzovaní perzistentných zadných dvierok AquaShell, nástrojov pre vytváranie reverzných tunelov SSH AquaTunnel...
2 distinct techniques documented for this family, organized by ATT&CK tactic.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Reverse-SSH backdoor used to establish remote access/tunneling from the compromised appliance back to attacker-controlled infrastructure.
A reverse-SSH tunneling implant used to establish covert remote access channels from compromised appliances back to attacker-controlled infrastructure.
A Go-based ReverseSSH variant used to establish persistent reverse SSH access from compromised Cisco AsyncOS appliances back to attacker-controlled servers, supporting stealthy remote access and pivoting.
Tool used to create reverse SSH tunnels on compromised Cisco devices for covert remote access or traffic forwarding.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.