Qlik Sense Servers Targeted in New Reverse Shell Attacks

Threat actors have been observed targeting Qlik Sense servers with PowerShell reverse shell commands in a series of attacks detected in October 2026. Cybersecurity firm Cynet’s CyOps and Research teams identified the suspicious activity against several E.U.-based customers, noting a narrow attack window of just over three minutes.

The latest campaign shares characteristics with a November 2023 offensive by the CACTUS ransomware operation, which weaponised previously disclosed flaws in Qlik Sense to gain initial access.

During the October 2026 incidents, attackers attempted to deliver a PowerShell command containing a one-line reverse shell designed to connect to a remote server on port 4455. Although these attempts were blocked by Cynet’s customers, subsequent analysis revealed the interactive communication channel is typically used for reconnaissance and to deploy a PowerShell script for persistence. This script leverages a Windows Go reverse shell to connect to the command-and-control server and seeks out running Apache ActiveMQ processes.

For Linux targets, the malware attempts to collect system information and read sensitive files such as /etc/shadow and /etc/passwd.

Persistence and Broader Exploitation Groundwork

A second variant of the PowerShell script focuses on establishing robust persistence. It attempts to install OpenSSH and creates a scheduled task named ‘WinUpdCheck’. This task launches another PowerShell reverse shell, written to C:\ProgramData\ssh\winc.ps1, at five-minute intervals. If OpenSSH is not available, the script downloads a legitimate OpenSSH-Win64.zip package from a staging server, extracts it, installs the service, sets it to automatic startup, and adds an inbound firewall rule for TCP port 22.

Further infrastructure analysis conducted by Cynet uncovered an exposed directory on the command-and-control server, revealing the threat actors’ broader intent. This directory contained a custom Go backdoor for Windows, SSH persistence scripts, an exploit for Apache ActiveMQ vulnerability CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711. This suggests the attackers are laying groundwork for multi-platform attacks beyond Qlik Sense.

Historical Context: CACTUS Ransomware Link

The latest activity shares traits with the November 2023 CACTUS ransomware campaign, where threat actors successfully exploited Qlik Sense Enterprise for Windows flaws to achieve initial access. These vulnerabilities, patched by Qlik in August and September 2023, included:

• CVE-2023-41265 (CVSS: 9.6): An HTTP tunneling vulnerability leading to privilege escalation and backend HTTP request execution.
• CVE-2023-41266 (CVSS: 8.2): A path traversal flaw allowing unauthenticated remote attackers to generate anonymous sessions and perform unauthorised HTTP requests.
• CVE-2023-48365 (CVSS: 9.6): An unauthenticated remote code execution (RCE) vulnerability, also known as DoubleQlik, which was an incomplete fix for CVE-2023-41265.

In the 2023 CACTUS campaign, attackers leveraged these flaws to gain a foothold, download additional payloads, and establish persistence and remote control using tools such as ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink. The command execution under scheduler.exe in the latest attacks resembles these earlier CACTUS intrusions, as detailed by Cynet’s research.