In a reverse shell attack, threat actors identify a target system and cause them to send a remote connection request. The attacker’s system acts as a listener and accepts the request, creating a remote shell to the victim’s device.
Once the connection is established, the listener executes malicious shellcode on the initiator's system, and might transfer data, display information, or perform file system operations on the listener's system. Because the victim’s device, typically a server, initiates the request, a reverse shell can bypass firewalls and overcome port address translation (PAT) and network address translation (NAT).