🧰 Reverse SSH tunnel

The items that name it 2

• China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  article2026-10-28It is written here as Reverse SSH tunnel: deployed to maintain access to the firewall and pivot to the management server.
• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  writeup2026-09-09It is written here as Reverse-SSH tunnel.

  used by UAT-11988 to forward ports (LDAP 389, LDAPS 636, Kerberos 88, SMB 445, NETBIOS 135, WinRM 5985) from internal hosts to attacker infrastructure