Operators target Qlik Sense servers with PowerShell reverse shells, stage ActiveMQ and Veeam exploits
Cynet's CyOps and Research teams observed short, concentrated intrusion attempts in October 2026 targeting Qlik Sense Enterprise for Windows, where attackers attempted to execute one-line PowerShell reverse shells and stage exploits/tools for Apache ActiveMQ and Veeam. The activity targeted several E.U.-based customers within a window of just over three minutes; the reverse-shell attempts were blocked but testing shows the channel would deliver a PowerShell persistence script and a Windows Go backdoor. The activity shares overlap with a November 2023 campaign linked to the CACTUS ransomware operation that weaponized Qlik Sense vulnerabilities fixed in August–September 2023 (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365). Cynet additionally found an exposed staging directory on 45.115.26[.]23 hosting a Go backdoor, an ActiveMQ exploit (CVE-2023-46604) and a modified Veeam toolchain (CVE-2024-40711), indicating the actor is preparing broader post-compromise operations (thehackernews.com).
Entenda a falha
A vulnerabilidade
Three Qlik Sense Enterprise for Windows flaws are in play. CVE-2023-41265 (CVSS 9.6) is an HTTP tunneling bug that lets an attacker escalate privileges and run HTTP requests on the backend server hosting the repository application. CVE-2023-48365 (CVSS 9.6, aka DoubleQlik) is an unauthenticated remote code execution caused by improper HTTP header validation, and is an incomplete fix for CVE-2023-41265. CVE-2023-41266 (CVSS 8.2) is a path traversal that lets an unauthenticated remote attacker create an anonymous session and reach unauthorized endpoints. Qlik patched them in August and September 2023; the articles give no version numbers. CVE-2023-46604 (Apache ActiveMQ) and CVE-2024-40711 (Veeam) appear only as tools staged by the attacker. The articles say the exact flaw used in the October 2026 intrusions is not known.
Como funciona
The articles describe the vulnerable flow only in outline. An unauthenticated HTTP request reaches the Qlik Sense server, and the software fails to validate headers or paths properly. This lets the request be tunneled to the backend repository application, or reach endpoints that should be off limits. In the 2023 CACTUS campaign this gave attackers a foothold. In the October 2026 activity, a PowerShell one-line reverse shell was executed under scheduler.exe, which resembles those 2023 intrusions. Cynet blocked the attempts, so the articles do not show how the command was triggered.
Por que é vulnerável
The root causes are missing or insufficient input validation: improper validation of HTTP headers in CVE-2023-48365, request tunneling to the backend in CVE-2023-41265, and path traversal in CVE-2023-41266. CVE-2023-48365 exists because the earlier fix for CVE-2023-41265 was incomplete, so the same weakness stayed reachable. The articles do not describe what the fixes change in detail.
Como foi descoberta
Cynet's CyOps and Research teams spotted the October 2026 activity against several E.U.-based customers, in a window of just over three minutes. Analysis of the attacker's infrastructure then turned up an exposed staging directory. The activity overlaps with a November 2023 CACTUS ransomware campaign documented by Arctic Wolf, which likely weaponized the newly disclosed Qlik Sense flaws for initial access. The articles do not say who found the original 2023 flaws or how they were reported to Qlik.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No PoC for the Qlik Sense flaws is mentioned. The attacker's exposed staging server (45.115.26[.]23:8012) hosted an ActiveMQ exploit for CVE-2023-46604 and a modified public Veeam toolchain for CVE-2024-40711, along with a Go backdoor and SSH persistence scripts. These are attacker tools seen in an operation, not a published PoC, so access is treated as private. Cynet reads this as the actor laying groundwork for broader attacks, so unpatched ActiveMQ and Veeam systems should be treated as urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 12:27.
Detalhes técnicos
- Detection: short-lived intrusion attempts in October 2026 against multiple E.U.-based Qlik Sense environments; command executed under scheduler.exe and attempts resembled 2023 CACTUS Qlik intrusions (thehackernews.com).
- Payloads and C2: observed PowerShell one-line reverse shell attempting to connect to 45.115.26[.]23:4455; interactive channel used to deliver a Windows Go reverse shell connecting to 45.115.26[.]23:4456.
- Post-exploitation actions: the Go backdoor looks for ActiveMQ-related processes; Linux variants attempt to collect system information and read
/etc/shadowand/etc/passwd. A second PowerShell variant installs OpenSSH, writesC:\ProgramData\ssh\winc.ps1, and creates a scheduled task namedWinUpdCheckto run the reverse shell every five minutes; if sshd is unavailable it downloadsOpenSSH-Win64.zipfrom the staging server and runsinstall-sshd.ps1, sets sshd to automatic startup, starts the service, and adds an inbound firewall rule for TCP/22 (thehackernews.com). - Staging infrastructure: an exposed directory at 45.115.26[.]23:8012 hosts a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711 (thehackernews.com).
- Historical context: the activity overlaps with a November 2023 CACTUS campaign that exploited Qlik Sense flaws patched in Aug–Sep 2023: CVE-2023-41265 (HTTP tunneling; CVSS 9.6), CVE-2023-41266 (path traversal; CVSS 8.2) and CVE-2023-48365 (HTTP header validation / unauthenticated RCE; CVSS 9.6) — the article states CVE-2023-48365 was an incomplete fix for CVE-2023-41265 (thehackernews.com).
Remediação
- Ensure all Qlik Sense Enterprise for Windows instances are patched to releases that remedied the Aug–Sep 2023 vulnerabilities and verify vendor guidance is applied.
- Block and monitor inbound/outbound traffic to and from 45.115.26[.]23 and the listed ports (4455, 4456, 8012); hunt for signs of
winc.ps1,install-sshd.ps1, theWinUpdCheckscheduled task and unexpected sshd service installations. - Search for indicators of compromise: execution under
scheduler.exe, presence of a Go backdoor, evidence of/etc/shadowaccess on Linux hosts, and ActiveMQ-related process anomalies; remove persistence and rotate credentials where exposure is suspected (thehackernews.com).
Linha do tempo
-
Operators target Qlik Sense servers with PowerShell reverse shells, stage ActiveMQ and Veeam exploits
ler a análise desta fonte ocultar
Cynet's CyOps and Research teams observed short, concentrated intrusion attempts in October 2026 targeting Qlik Sense Enterprise for Windows, where attackers attempted to execute one-line PowerShell reverse shells and stage exploits/tools for Apache ActiveMQ and Veeam. The activity targeted several E.U.-based customers within a window of just over three minutes; the reverse-shell attempts were blocked but testing shows the channel would deliver a PowerShell persistence script and a Windows Go backdoor. The activity shares overlap with a November 2023 campaign linked to the CACTUS ransomware operation that weaponized Qlik Sense vulnerabilities fixed in August–September 2023 (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365). Cynet additionally found an exposed staging directory on 45.115.26[.]23 hosting a Go backdoor, an ActiveMQ exploit (CVE-2023-46604) and a modified Veeam toolchain (CVE-2024-40711), indicating the actor is preparing broader post-compromise operations (thehackernews.com).
Technical Details
- Detection: short-lived intrusion attempts in October 2026 against multiple E.U.-based Qlik Sense environments; command executed under scheduler.exe and attempts resembled 2023 CACTUS Qlik intrusions (thehackernews.com).
- Payloads and C2: observed PowerShell one-line reverse shell attempting to connect to 45.115.26[.]23:4455; interactive channel used to deliver a Windows Go reverse shell connecting to 45.115.26[.]23:4456.
- Post-exploitation actions: the Go backdoor looks for ActiveMQ-related processes; Linux variants attempt to collect system information and read
/etc/shadowand/etc/passwd. A second PowerShell variant installs OpenSSH, writesC:\ProgramData\ssh\winc.ps1, and creates a scheduled task namedWinUpdCheckto run the reverse shell every five minutes; if sshd is unavailable it downloadsOpenSSH-Win64.zipfrom the staging server and runsinstall-sshd.ps1, sets sshd to automatic startup, starts the service, and adds an inbound firewall rule for TCP/22 (thehackernews.com). - Staging infrastructure: an exposed directory at 45.115.26[.]23:8012 hosts a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711 (thehackernews.com).
- Historical context: the activity overlaps with a November 2023 CACTUS campaign that exploited Qlik Sense flaws patched in Aug–Sep 2023: CVE-2023-41265 (HTTP tunneling; CVSS 9.6), CVE-2023-41266 (path traversal; CVSS 8.2) and CVE-2023-48365 (HTTP header validation / unauthenticated RCE; CVSS 9.6) — the article states CVE-2023-48365 was an incomplete fix for CVE-2023-41265 (thehackernews.com).
Remediation
- Ensure all Qlik Sense Enterprise for Windows instances are patched to releases that remedied the Aug–Sep 2023 vulnerabilities and verify vendor guidance is applied.
- Block and monitor inbound/outbound traffic to and from 45.115.26[.]23 and the listed ports (4455, 4456, 8012); hunt for signs of
winc.ps1,install-sshd.ps1, theWinUpdCheckscheduled task and unexpected sshd service installations. - Search for indicators of compromise: execution under
scheduler.exe, presence of a Go backdoor, evidence of/etc/shadowaccess on Linux hosts, and ActiveMQ-related process anomalies; remove persistence and rotate credentials where exposure is suspected (thehackernews.com).