Qlik Sense servers hit with blocked reverse-shell attempts
Original title: Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Cynet blocked the October attempts; the operator’s server also staged ActiveMQ and Veeam exploit tooling.
Cynet said threat actors tried in October 2026 to run PowerShell reverse shells on Qlik Sense servers at several EU customers, all within just over three minutes. The attempts were blocked. The activity overlaps a November 2023 campaign Arctic Wolf linked to CACTUS, which used then-new Qlik Sense flaws, but Cynet says the vulnerability used this time is unknown. The operator’s server also held a Go backdoor, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified Veeam toolchain for CVE-2024-40711.
Unconfirmed: Cynet says the exact vulnerability used to access the Qlik Sense servers is not known.
- Commands connected to 45.115.26[.]23 on port 4455 and ran under scheduler.exe.
- A follow-on Go reverse shell used port 4456 and looked for Apache ActiveMQ.
- One script installed OpenSSH and a scheduled task named WinUpdCheck.
- Linux behavior included reading /etc/shadow and /etc/passwd.
- Qlik flaws cited from 2023 are CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365.
Impact: Attempted remote shells and persistence on Qlik Sense servers
| Product | Affected |
|---|---|
| Qlik Sense Enterprise for Windows | — |
| Apache ActiveMQ | — |
| Veeam | — |
- 1.Check Qlik Sense hosts for scheduler.exe launching PowerShell reverse shells.
- 2.Look for scheduled task WinUpdCheck and C:\ProgramData\ssh\winc.ps1.
- 3.Review connections to 45.115.26[.]23 on ports 4455, 4456, and 8012.
- Products
- Qlik SenseActiveMQ
- Threat actors
- CACTUS
- Organizations
- CynetArctic Wolf
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2023-41265+1 related CVE | HTTP Request Tunneling Privilege Escalation in Qlik Sense Enterprise for Windows | 9.9 group max | 88% | KEVRansomware | KEV |
| CVE-2023-46604 | Unauthenticated RCE in Apache ActiveMQ via OpenWire Deserialization | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-48365 | HTTP Request Smuggling/Tunneling in Qlik Sense Allows Privilege Escalation | 9.9 | 48% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 45.115.26.23 | mand containing a one-line reverse shell that connects to " 45.115.26[.]23 " on port 4455. The exact vulnerability exploited to brea |
From the original article
2 min read at thehackernews.com
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E. U.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.