Loading malware…
AquaShell is a lightweight Python-based backdoor deployed on compromised Cisco Secure Email Gateway and Secure Email and Web Manager appliances running AsyncOS. It is embedded into web-server components and operates as a passive listener, accepting encoded commands through unauthenticated HTTP POST requests and executing them in the underlying system shell. The malware provides persistent command execution on compromised appliances. AquaShell was observed in exploitation of CVE-2025-20393, an AsyncOS Spam Quarantine vulnerability enabling unauthenticated root-level command execution on exposed, affected appliances. Cisco Talos tracked AquaShell as part of activity associated with the China-nexus threat actor UAT-9686; accompanying tooling included reverse-tunneling and log-clearing utilities.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“AquaShell, a persistent Python backdoor; AquaTunnel and Chisel for reverse SSH tunneling; AquaPurge, a log-clearing utility to erase the evidence.”
Cisco observed that successful exploitation of the vulnerability resulted in the deployment of the custom webshell AquaShell, a Python-based backdoor capable of receiving and executing encoded commands in the system shell.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
AquaShell, a Python-based backdoor capable of receiving and executing encoded commands in the system shell
Cisco published an advisory regarding a zero-day Remote Code Execution (RCE) vulnerability impacting Cisco AsyncOS Software... Successful exploitation of the vulnerability could allow attackers to obtain full remote control of the affected device
Podľa skupiny Cisco Talos zraniteľnosť zneužíva čínska skupina UAT‑9686 pri nasadzovaní perzistentných zadných dvierok AquaShell...
Cisco observed that successful exploitation of the vulnerability resulted in the deployment of the custom webshell AquaShell
“UAT-9686 deploys a custom persistence mechanism we track as “AquaShell”… reverse tunneling and purging logs.”
“AquaShell, a persistent Python backdoor”; Cisco’s subsequent updates “also removed the implanted persistence mechanisms.”
“AquaShell, a persistent Python backdoor”; Cisco’s subsequent updates “also removed the implanted persistence mechanisms.”
“UAT-9686 deploys a custom persistence mechanism we track as “AquaShell”… reverse tunneling and purging logs.”
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.