CACTUS-linked Qlik Sense intrusions: Qlik Sense — reverse shell attacks staging ActiveMQ and Veeam exploits (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365)
Severity: high · Patch status: patched · Since 2026-11-11 · CVE-2023-41265, CVE-2023-41266, CVE-2023-46604, CVE-2023-48365, CVE-2024-40711
Cynet's CyOps detected October 2026 attempts against several EU-based customers to deliver PowerShell reverse shells via Qlik Sense servers, executed under scheduler.exe and resembling the November 2023 CACTUS ransomware intrusions that exploited Qlik Sense flaws CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365 (DoubleQlik). The reverse shell connects to 45.115.26[.]23:4455, conducts reconnaissance, deploys a Go backdoor, hunts for Apache ActiveMQ processes, and on Linux reads /etc/shadow and /etc/passwd. A variant installs OpenSSH with a scheduled task 'WinUpdCheck' for persistence. Exposed infrastructure contained an ActiveMQ CVE-2023-46604 exploit and a modified Veeam toolchain for CVE-2024-40711, suggesting preparation for broader attacks. All Qlik flaws were patched in 2023; the initial access vector remains unknown.
What to do
- Verify Qlik Sense servers are fully patched for CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365 and hunt for scheduler.exe-spawned PowerShell and connections to 45.115.26[.]23
- Patch Apache ActiveMQ against CVE-2023-46604 and Veeam against CVE-2024-40711
- Check for OpenSSH installs, the 'WinUpdCheck' scheduled task, C:\ProgramData\ssh\winc.ps1, and unexpected inbound TCP 22 firewall rules
- Monitor for reverse shells on unusual ports and review scheduled tasks and persistence mechanisms on Windows and Linux hosts
Fixed versions
- Qlik Sense patches released August–September 2023
Sources
All live incidents on Threat Watch
