In October 2026, a concerning trend emerged as threat actors began targeting Qlik Sense servers with attempts to deliver malicious PowerShell reverse shell commands across multiple environments. This alarming activity was identified by Cynet’s CyOps and Research teams, who noted that these incidents predominantly affected European Union-based clients within a remarkably short span of just over three minutes.
The context of these attacks indicates a shared lineage with a separate incident that occurred in November 2023, as detailed by Arctic Wolf. In that earlier campaign, actors associated with the CACTUS ransomware group effectively exploited newly disclosed vulnerabilities in Qlik Sense to gain initial access to targeted environments. These vulnerabilities were significant enough to warrant urgent attention, as they had been patched by Qlik Sense just months prior, in August and September 2023.
The vulnerabilities in question pertain specifically to Qlik Sense Enterprise for Windows, and they encompass several critical issues. One of the most severe is identified as CVE-2023-41265, which carries a CVSS score of 9.6. This particular vulnerability pertains to an HTTP tunneling flaw that could enable privilege escalation, allowing attackers to execute unauthorized HTTP requests on the back-end server that hosts the repository application.
Another issue, designated as CVE-2023-41266, received a score of 8.2. This path traversal vulnerability could permit unauthenticated remote attackers to generate arbitrary sessions and perform HTTP requests aimed at unauthorized endpoints. Furthermore, CVE-2023-48365, also rated at 9.6, involves unauthenticated remote code execution due to the inadequate validation of HTTP headers, allowing attackers to elevate privileges significantly.
Moreover, it’s important to highlight that CVE-2023-48365, often referred to as DoubleQlik, is essentially an incomplete fix for the earlier CVE-2023-41265. This interconnectedness among vulnerabilities showcases the complexity and severity of the security landscape surrounding Qlik Sense applications.
During the initial November 2023 CACTUS ransomware campaign, the threat actors were observed utilizing these vulnerabilities to establish a foothold within compromised systems. They downloaded additional payloads that enabled them to maintain persistence and remote control. This process included the deployment of various tools, such as ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.
The latest activities uncovered by Cynet revealed the deployment of a PowerShell command that features a one-line reverse shell capable of connecting to a remote address at port 4455. While the exact vulnerabilities exploited to infiltrate the Qlik Sense servers remain undetermined, the behavior exhibited during this latest incident reflects patterns similar to the earlier CACTUS intrusions.
Cynet’s analysis emphasizes that, although the attempts to create the reverse shell were thwarted, their controlled testing revealed the potential of this reverse shell to conduct reconnaissance and facilitate the delivery of PowerShell scripts that would enable ongoing persistence within compromised networks. This capability is essential for threat actors who wish to maintain their foothold in targeted environments.
One variant of the PowerShell script utilized in this operation attempts to install OpenSSH on compromised machines. It sets up a scheduled task named “WinUpdCheck” to continuously launch a PowerShell reverse shell script located at “C:\ProgramData\ssh\winc.ps1” every five minutes. Should the necessary components not be available, the script resorts to downloading and executing OpenSSH from a designated staging server, effectively preparing the environment for remote access.
In a further probing of the digital infrastructure linked to these attacks, Cynet identified an exposed directory containing a customized Go backdoor for Windows, persistence scripts for SSH, and an exploit for CVE-2023-46604 affecting Apache ActiveMQ. This discovery suggests that the threat actors may be laying the groundwork for even broader assaults, aiming to broaden their reach within targeted networks.
In conclusion, the escalation of cyber threats associated with Qlik Sense environments highlights an urgent need for robust defensive mechanisms and proactive security measures. Organizations must prioritize vulnerability assessments and timely patching to safeguard their systems from such sophisticated attacks. As cyber threats continue to evolve, so too must the strategies employed by companies to protect their valuable data and infrastructure.