Loading malware…
AquaTunnel is a Go-based reverse SSH backdoor derived from the open-source ReverseSSH project. It establishes an outbound reverse SSH connection from a compromised system to attacker-controlled infrastructure, enabling remote access across firewall and NAT boundaries. It was deployed following exploitation of CVE-2025-20393 in Cisco Secure Email Gateway and Secure Email and Web Manager appliances, alongside AquaShell, Chisel, and AquaPurge. Cisco Talos associated this activity with the China-nexus threat actor UAT-9686 with moderate confidence. AquaTunnel supports persistent remote access to compromised network-security appliances and was used with tunneling tools to facilitate internal pivoting.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“AquaShell, a persistent Python backdoor; AquaTunnel and Chisel for reverse SSH tunneling; AquaPurge, a log-clearing utility to erase the evidence.”
Reported attacks also resulted in the deployment of the reverse SSH tunneling tools AquaTunnel and Chisel, which can enable unauthorized remote access...
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Cisco published an advisory regarding a zero-day Remote Code Execution (RCE) vulnerability impacting Cisco AsyncOS Software... Successful exploitation of the vulnerability could allow attackers to obtain full remote control of the affected device
...pri nasadzovaní perzistentných zadných dvierok AquaShell, nástrojov pre vytváranie reverzných tunelov SSH AquaTunnel...
Reported attacks also resulted in the deployment of the reverse SSH tunneling tools AquaTunnel and Chisel, which can enable unauthorized remote access
“AquaTunnel and Chisel [were used] for reverse SSH tunneling.”
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.