ReverseSSH

ReverseSSH, also referred to as AquaTunnel, is a tunneling/backdoor utility used to establish encrypted reverse SSH tunnels from compromised systems to attacker-controlled infrastructure, enabling remote access, command-and-control, and data exfiltration while bypassing network security controls and firewalls. In the provided reporting, AquaTunnel is described as a Go-based variant of the open-source ReverseSSH backdoor. It was deployed post-exploitation on Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS after compromise via the Spam Quarantine remote code execution vulnerabilities CVE-2025-20393 and, in related reporting, CVE-2024-20353, when the feature was enabled and internet-exposed. Cisco attributed this activity to the China-nexus threat actor UAT-9686, and the use of AquaTunnel/ReverseSSH was also noted as previously associated with Chinese threat groups including APT41 and UNC5174. In the observed campaigns, ReverseSSH was used alongside Chisel, AquaPurge, and the Python backdoor AquaShell to maintain persistent remote access and support follow-on intrusion activity. High-confidence indicators from the content are the malware names/aliases ReverseSSH and AquaTunnel and its role as an SSH tunneling utility used on compromised Cisco AsyncOS appliances in UAT-9686 operations.