Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Threat actors have been targeting Qlik Sense servers to deliver PowerShell reverse shell commands against multiple environments in October 2026.
Cynet's CyOps and Research teams identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity shares overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense.
Known Vulnerabilities
The vulnerabilities in question, patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows. These include CVE-2023-41265 (CVSS score: 9.6), an HTTP tunneling vulnerability; CVE-2023-41266 (CVSS score: 8.2), a path traversal vulnerability; and CVE-2023-48365 (CVSS score: 9.6), an unauthenticated remote code execution vulnerability. Notably, CVE-2023-48365, also known as DoubleQlik, is an incomplete fix for CVE-2023-41265.
Attack Techniques
The latest activity involves a PowerShell command containing a one-line reverse shell that connects to "45.115.26[.]23" on port 4455. Although attempts to spawn the reverse shell were blocked, testing revealed that the interactive communication channel is used for reconnaissance and delivering PowerShell scripts for persistence.
The command was executed under scheduler.exe, resembling the 2023 Cactus Qlik intrusions.
A second variant attempts to install OpenSSH and creates a scheduled task named "WinUpdCheck" that launches a PowerShell reverse shell at five-minute intervals. The backdoor is also used to look for actively running processes related to Apache ActiveMQ.
Broader Attack Preparation
Analysis of the infrastructure has uncovered an exposed directory consisting of a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711. This indicates the threat actor is possibly laying the groundwork for broader attacks.
Related
