Attackers are exploiting a patched vCenter flaw to plant reverse SSH tunnels and hold onto compromised servers.