Hackers Target Qlik Sense Servers With Reverse Shells and Exploits
Threat actors leverage Qlik Sense vulnerabilities to deploy persistent backdoors and staging tools.
1Targeted Qlik Sense Attacks
In October 2026, threat actors targeted Qlik Sense servers to execute PowerShell reverse shell commands. Cynet researchers identified these suspicious activities across multiple European Union-based environments. The attacks occurred within a narrow three-minute window, indicating a highly automated approach to identifying and compromising vulnerable enterprise server infrastructure during the observation period.
2Historical Campaign Overlap
The recent activity mirrors a November 2023 campaign linked to the CACTUS ransomware group. That earlier operation weaponized vulnerabilities in Qlik Sense Enterprise for Windows to gain initial access. The current attackers appear to follow similar operational patterns, utilizing scheduler.exe to execute malicious commands, suggesting a continuity in threat actor tactics.
3Vulnerability Context and Persistence
The attacks target flaws in Qlik Sense Enterprise for Windows, specifically CVE-2023-48365, which serves as an incomplete patch for CVE-2023-41265. While initial reverse shell attempts were blocked, testing revealed the channel facilitates reconnaissance. Attackers aim to deliver scripts that enable persistence, ensuring long-term access even if the primary entry point is secured.
4Advanced Backdoor Mechanisms
Attackers employ a Windows Go-based reverse shell connecting to a remote server on port 4456. This backdoor performs system reconnaissance, specifically targeting Apache ActiveMQ processes. On Linux systems, the malware attempts to harvest sensitive system information by accessing critical files like /etc/shadow and /etc/passwd, demonstrating a broad cross-platform malicious intent.
5Automated SSH Deployment
A secondary script variant automates the installation of OpenSSH to maintain persistent access. It creates a scheduled task named WinUpdCheck that triggers every five minutes. If SSH is unavailable, the script downloads a legitimate OpenSSH package, configures it for automatic startup, and modifies firewall rules to permit inbound traffic on TCP port 22.
6Staging Server Infrastructure
Analysis of the attacker's infrastructure revealed an exposed directory containing custom Go backdoors and SSH persistence scripts. The server also hosts an exploit for Apache ActiveMQ vulnerability CVE-2023-46604 and a modified toolchain for Veeam vulnerability CVE-2024-40711. This repository suggests the actors are preparing for broader, multi-stage attacks against diverse enterprise software targets.
7Operational Security Implications
The use of legitimate tools like OpenSSH alongside custom Go backdoors complicates detection efforts. By reusing standard software packages, attackers blend their malicious persistence mechanisms with normal administrative traffic. Security teams must monitor for unauthorized scheduled tasks and unexpected firewall rule modifications to identify these stealthy attempts at maintaining long-term server access.
8Strategic Defensive Outlook
These incidents highlight the persistent risk posed by unpatched enterprise software vulnerabilities. Organizations must prioritize identity visibility and attack surface management to mitigate such threats. As attackers continuously refine their staging toolkits, proactive incident response and rigorous patch management remain the most effective defenses against these evolving, highly coordinated cyber intrusion campaigns.