In a recent wave of cyber threats, attackers have been focusing on Qlik Sense servers, attempting to deploy PowerShell-based reverse shells in various environments during October 2026. These activities have been reported by Cynet’s CyOps and Research teams, who observed the attacks directed at several European Union-based companies over a brief period of just over three minutes.
The recent incidents bear similarities to a campaign from November 2023, where the CACTUS ransomware group exploited newly disclosed vulnerabilities in Qlik Sense to gain initial access to systems. Despite patches released in August and September 2023, the vulnerabilities remain a significant concern for Qlik Sense Enterprise users operating on Windows.
Vulnerabilities Exploited
Among the critical flaws are CVE-2023-41265, a severe HTTP tunneling vulnerability with a CVSS score of 9.6, which could allow privilege escalation and unauthorized HTTP requests. Another, CVE-2023-41266, is a path traversal issue with a CVSS score of 8.2, permitting unauthenticated attackers to establish anonymous sessions and access restricted endpoints. The DoubleQlik vulnerability, CVE-2023-48365, is an incomplete fix for CVE-2023-41265, further complicating security efforts.
These vulnerabilities were previously exploited in a 2023 campaign by CACTUS ransomware actors to secure a foothold in systems, enabling them to deploy additional payloads such as ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink, to maintain persistence and remote control.
Recent Attack Patterns
The latest intrusion attempts discovered by Cynet involved a PowerShell command executing a reverse shell connecting to the IP address 45.115.26[.]23 on port 4455. Although the exact vulnerability used to infiltrate Qlik Sense servers remains uncertain, the command execution through scheduler.exe mirrors past CACTUS intrusions.
Even though these reverse shell attempts were thwarted, Cynet’s controlled experiments revealed that these attacks establish an interactive channel to conduct reconnaissance and deploy a PowerShell script designed for persistence. This involves a Windows Go reverse shell linked to 45.115.26[.]23:4456, which also targets running processes associated with Apache ActiveMQ. On Linux, the malware attempts to gather system data and access sensitive files such as ‘/etc/shadow’ and ‘/etc/passwd’.
Broader Implications and Analysis
A variant of the PowerShell script also attempts to install OpenSSH, creating a scheduled task named ‘WinUpdCheck’ to trigger a reverse shell every five minutes. If the sshd service is unavailable, the attack downloads and installs OpenSSH components from a staging server, configuring it to start automatically and allowing firewall access on TCP 22.
Further investigation uncovered an exposed directory at 45.115.26[.]23:8012, housing a custom Windows Go backdoor, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified Veeam toolchain for CVE-2024-40711. This infrastructure suggests that the attackers are preparing for more extensive campaigns targeting diverse technologies.
The continued exploitation of patched vulnerabilities in Qlik Sense underscores the challenges organizations face in securing their environments against sophisticated cyber threats. Vigilance and timely application of security updates remain critical in mitigating such risks.
