Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits Ravie LakshmananNov 11, 2026Cyber Attack / Ransomware Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense to obtain initial access to target environments. The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows - CVE-2023-41265 (CVSS score: 9.6) - An HTTP tunneling vulnerability that could lead to privilege escalation and allow an attacker to execute HTTP requests on the backend server hosting the repository application. CVE-2023-41266 (CVSS score: 8.2) - A path traversal vulnerability that could allow an unauthenticated remote attacker to generate an anonymous session and perform HTTP requests to unauthorized endpoints. CVE-2023-48365 (CVSS score: 9.6) - An unauthenticated remote code execution vulnerability that stems from improper validation of HTTP headers, allowing an attacker to elevate their privilege by tunneling HTTP requests and execute HTTP requests on the backend server. It's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265. In November 2023 CACTUS ransomware campaign, threat actors were observed exploiting the flaws to establish a foothold and download additional payloads to establish persistence and remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink. The latest activity detected by Cynet involves the use of a PowerShell command containing a one-line reverse shell that connects to "45.115.26[.]23" on port 4455. The exact vulnerability exploited to break into Qlik Sense servers is currently not known. "The command was executed under scheduler.exe, resembling the 2023 Cactus Qlik intrusions," the cybersecurity company said. Although attempts to spawn the reverse shell were blocked, Cynet's testing of the reverse shell in a controlled environment has revealed that the interactive communication channel is used to conduct reconnaissance and deliver a PowerShell script for enabling persistence. This is achieved by means of a Windows Go reverse shell that connects to "45.115.26[.]23:4456." The backdoor is then used to look for actively running processes related to Apache ActiveMQ. On Linux, the malware also attempts to collect system information and read "/etc/shadow" and "/etc/passwd" files. A second variant of the PowerShell script attempts to install OpenSSH and creates a scheduled task named "WinUpdCheck" that launches a PowerShell reverse shell written to "C:\ProgramData\ssh\winc.ps1" at five-minute intervals. "If sshd remained unavailable, it downloaded OpenSSH-Win64.zip from the staging server, extracted it, and ran install-sshd.ps1," Cynet said. "It set sshd to automatic startup, started the service, and added an inbound firewall rule for TCP 22. The archive was a legitimate OpenSSH package reused by the operator." Further analysis of the infrastructure has uncovered an exposed directory ("45.115.26[.]23:8012") consisting of a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711, indicating the threat actor is possibly laying the groundwork for broader attacks. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, Malware, network security, ransomware, Vulnerability The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 The Flood is Coming And The Pipes Were Already Full OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk