Attackers Target Qlik Sense Servers with Reverse Shells, Preloaded ActiveMQ and Veeam Exploits

Qlik Sense servers hit by targeted attack, activity linked to past CACTUS operations

In October 2026, researchers observed a threat actor attacking Qlik Sense servers across multiple environments, attempting to deliver a PowerShell reverse shell command, but the attempt was unsuccessful.

Cynet's CyOps and research team said they detected the related suspicious activity in October 2026, targeting several customers in the EU region, with the entire time window lasting just over three minutes.

Analysis found that the activity partially overlaps in characteristics with an attack campaign documented by Arctic Wolf in November 2023. At that time, threat actors associated with the CACTUS ransomware operators weaponized a then-newly disclosed vulnerability in Qlik Sense to gain initial access to target environments.

Qlik Sense released patches for all the vulnerabilities involved between August and September 2023. These vulnerabilities affect Qlik Sense Enterprise on Windows and include:

• CVE-2023-41265 (CVSS score 9.6): an HTTP tunneling vulnerability that can lead to privilege escalation, allowing attackers to execute HTTP requests on the backend server hosting repository apps.

• CVE-2023-41266 (CVSS score 8.2): a path traversal vulnerability that allows unauthenticated remote attackers to create anonymous sessions and send HTTP requests to unauthorized endpoints.

• CVE-2023-48365 (CVSS score 9.6): an unauthenticated remote code execution vulnerability caused by improper HTTP header validation, allowing attackers to escalate privileges via HTTP tunnel requests and execute HTTP requests on the backend server.

Notably, CVE-2023-48365 (also known as DoubleQlik) was the patch for CVE-2023-41265 and did not fully fix the original vulnerability.

In the November 2023 CACTUS ransomware campaign, researchers observed threat actors exploiting the above vulnerabilities to establish a foothold, download additional payloads, and achieve persistence and remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.

Attack delivers PowerShell reverse shell, enabling persistence and cross-platform reconnaissance

The latest campaign monitored by Cynet used a PowerShell command containing a one-liner reverse shell that connects to port 4455 on 45.115.26[.]23. The specific vulnerability the attackers exploited to breach the Qlik Sense servers has not yet been determined.

"The command was executed via the scheduler.exe process, similar to the characteristics of the 2023 CACTUS intrusion campaign against Qlik," the security vendor said.

Although the attacker's attempt to deliver the reverse shell was blocked, Cynet tested the reverse shell in a controlled environment and found that attackers could use this interactive communication channel to conduct reconnaissance and deliver PowerShell scripts for persistence.

Persistence is achieved through a Windows reverse shell written in Go, which connects to port 4456 on 45.115.26[.]23. The attacker then uses this backdoor to look for running Apache ActiveMQ-related processes. On Linux, the malware also attempts to collect system information and read the /etc/shadow and /etc/passwd files.

Another variant of the PowerShell script attempts to install OpenSSH and creates a scheduled task named "WinUpdCheck" that launches a PowerShell reverse shell written to C:\ProgramData\ssh\winc.ps1 every five minutes.

"If the sshd service is unavailable, the script downloads the OpenSSH-Win64.zip archive from the attack staging server, extracts it, and runs the install-sshd.ps1 script. The script sets sshd to start automatically, starts the service, and adds an inbound firewall rule for TCP port 22. The archive is a legitimate OpenSSH installation package reused by the attackers," Cynet said.

Attackers stage exploit tools for multiple products, possibly preparing a broader attack

Further analysis of the attack infrastructure revealed an exposed directory on port 8012 of 45.115.26[.]23 containing a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit tool targeting CVE-2023-46604, and a modified version of a public Veeam toolchain targeting CVE-2024-40711.

This suggests the threat actor may be preparing for a subsequent, broader attack.

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits