Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.
Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes.
The activity has been found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense to obtain initial access to target environments.
The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows - It's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265.
In November 2023 CACTUS ransomware campaign, threat actors were observed exploiting the flaws to establish a foothold and download more payloads to establish persistence and remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.
The exact vulnerability exploited to break into Qlik Sense servers is currently not known, and on Linux, the malware also attempts to collect system information and read /etc/shadow and /etc/passwd files.
Further analysis of the infrastructure has uncovered an exposed directory () consisting of a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711, indicating the threat actor is possibly laying the groundwork for broader attacks.
The latest activity detected by Cynet involves the use of a PowerShell command containing a one-line reverse shell that connects to on port 4455.
Although attempts to spawn the reverse shell were blocked, Cynet's testing of the reverse shell in a controlled environment has revealed that the interactive communication channel is used to conduct reconnaissance and deliver a PowerShell script for enabling persistence.
The backdoor is then used to look for actively running processes related to Apache ActiveMQ.
A second variant of the PowerShell script attempts to install OpenSSH and creates a scheduled task named WinUpdCheck that launches a PowerShell reverse shell written to at five-minute intervals.
What happened
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.
Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes.
The activity has been found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense to obtain initial access to target environments.
What changed
The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows - It's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265.
In November 2023 CACTUS ransomware campaign, threat actors were observed exploiting the flaws to establish a foothold and download more payloads to establish persistence and remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.
Who is affected
The exact vulnerability exploited to break into Qlik Sense servers is currently not known, and on Linux, the malware also attempts to collect system information and read /etc/shadow and /etc/passwd files.
Why it matters
Further analysis of the infrastructure has uncovered an exposed directory () consisting of a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711, indicating the threat actor is possibly laying the groundwork for broader attacks.
Technical details
The latest activity detected by Cynet involves the use of a PowerShell command containing a one-line reverse shell that connects to on port 4455.
Although attempts to spawn the reverse shell were blocked, Cynet's testing of the reverse shell in a controlled environment has revealed that the interactive communication channel is used to conduct reconnaissance and deliver a PowerShell script for enabling persistence.
The backdoor is then used to look for actively running processes related to Apache ActiveMQ.
Response
A second variant of the PowerShell script attempts to install OpenSSH and creates a scheduled task named WinUpdCheck that launches a PowerShell reverse shell written to at five-minute intervals.
What remains unknown
The exact vulnerability exploited to break into Qlik Sense servers is currently not known.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.