Loading malware…
ReverseSSH, also referred to as AquaTunnel, is a tunneling/backdoor utility used to establish encrypted reverse SSH tunnels from compromised systems to attacker-controlled infrastructure, enabling remote access, command-and-control, and data exfiltration while bypassing network security controls and firewalls. In the provided reporting, AquaTunnel is described as a Go-based variant of the open-source ReverseSSH backdoor. It was deployed post-exploitation on Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS after compromise via the Spam Quarantine remote code execution vulnerabilities CVE-2025-20393 and, in related reporting, CVE-2024-20353, when the feature was enabled and internet-exposed. Cisco attributed this activity to the China-nexus threat actor UAT-9686, and the use of AquaTunnel/ReverseSSH was also noted as previously associated with Chinese threat groups including APT41 and UNC5174. In the observed campaigns, ReverseSSH was used alongside Chisel, AquaPurge, and the Python backdoor AquaShell to maintain persistent remote access and support follow-on intrusion activity. High-confidence indicators from the content are the malware names/aliases ReverseSSH and AquaTunnel and its role as an SSH tunneling utility used on compromised Cisco AsyncOS appliances in UAT-9686 operations.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...AquaTunnel, a Go-based variant of the OSS 'ReverseSSH' backdoor."
1 distinct technique documented for this family, organized by ATT&CK tactic.
To ensure persistence after lateral movements, Houken operators notably deployed the following GOREVERSE payloads... The following public tools were observed on the victims’ network... Backdoors and other persistence mechanisms: – GOREVERSE (reverse_ssh); – ReverseSSH; – SparkRAT;
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.