Cynet Details Qlik Sense Targeting With Reverse Shells and Staged Exploits
Summary
Cynet reports blocked PowerShell reverse-shell attempts against Qlik Sense servers in October 2026. Testing and infrastructure analysis revealed persistence scripts, a Go backdoor, and staged ActiveMQ and Veeam exploit tools; the initial-access vulnerability is unknown.
Key points
- Cynet identified activity against several E.U.-based customers in October 2026, within a period of just over three minutes.
- PowerShell reverse-shell attempts against Qlik Sense servers were blocked; the vulnerability used for initial access is unknown.
- In controlled testing, the reverse shell supported reconnaissance and delivery of a persistence script; a Windows Go backdoor connected to the same infrastructure.
- A Linux variant attempted to collect system information and read /etc/shadow and /etc/passwd, and checked for running Apache ActiveMQ processes.
- A script attempted to install OpenSSH and create a scheduled task named WinUpdCheck to launch a PowerShell reverse shell every five minutes.
- An exposed staging directory contained a custom Go backdoor, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711.
- Cynet said the activity resembled aspects of a 2023 Qlik Sense campaign linked to CACTUS, but the article does not establish that the current activity is connected to that operation.
Article Details
- Attack Vectors
- Threat actors targeted Qlik Sense servers; the exact vulnerability used in the October 2026 activity is unknown.
- A PowerShell reverse shell attempted to connect to 45.115.26[.]23 on port 4455. Cynet reported that the attempts were blocked.
- In controlled testing, Cynet observed the reverse-shell channel being used for reconnaissance and delivery of a PowerShell persistence script.
- A Windows Go backdoor looked for running processes related to Apache ActiveMQ. On Linux, malware attempted to collect system information and read /etc/shadow and /etc/passwd.
- A PowerShell script created a scheduled task named WinUpdCheck to launch a reverse shell every five minutes. It also installed OpenSSH when sshd was unavailable, configured the service to start automatically, and added an inbound firewall rule for TCP 22.
- An exposed directory on 45.115.26[.]23 contained an ActiveMQ exploit for CVE-2023-46604 and a modified public Veeam toolchain for CVE-2024-40711; the article says these may indicate preparation for broader attacks.
- Defensive Notes
- Qlik patched the vulnerabilities discussed in connection with the 2023 activity in August and September 2023. The article does not identify the vulnerability used in the October 2026 activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]115[.]26[.]23 | Infrastructure used for reverse-shell connections and as the staging server hosting attacker tooling and persistence scripts. |
MITRE ATT&CK
T1003.008 · /etc/passwd and /etc/shadowOn Linux, the malware attempted to read /etc/passwd and /etc/shadow.T1053.005 · Scheduled TaskA scheduled task named WinUpdCheck launched a PowerShell reverse shell every five minutes.T1057 · Process DiscoveryThe Windows Go backdoor searched for running processes related to Apache ActiveMQ.T1059.001 · PowerShellPowerShell commands and scripts were used for reverse-shell access and persistence.T1082 · System Information DiscoveryOn Linux, the malware attempted to collect system information.T1105 · Ingress Tool TransferWhen sshd was unavailable, the script downloaded OpenSSH-Win64.zip from the staging server.T1543.003 · Windows ServiceThe script installed sshd, set it to start automatically, and started the service.T1562.004 · Disable or Modify System FirewallThe script added an inbound firewall rule for TCP 22.
CVE
CVE-2023-41265qlik · qlik_senseIt's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265.CVE-2023-46604Apache Software Foundation · Apache ActiveMQ; Apache Software Foundation · Apache ActiveMQ Legacy OpenWire Moduleconsisting of a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711, indicating the threat actor is possiblyCVE-2023-48365Qlik · Qlik senseIt's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265.CVE-2024-40711veeam · backup_\&_replication; Veeam · Backup and Recoveryscripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711, indicating the threat actor is possibly laying the groundwork for broader attacks.
Threat Actors
Vendors
CynetCynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes.QlikThreat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.
Products
AnyDeskand remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.Apache ActiveMQ"45.115.26[.]23:4456." The backdoor is then used to look for actively running processes related to Apache ActiveMQ. On Linux, the malware also attempts to collect system information and read "/etc/shadow" andManageEngine Unified Endpoint Management and Security (UEMS)additional payloads to establish persistence and remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.OpenSSHA second variant of the PowerShell script attempts to install OpenSSH and creates a scheduled task named "WinUpdCheck" that launches a PowerShell reverse shell written to "C:\ProgramData\ssh\winc.ps1" at five-minuteQlik Sense Enterprise for WindowsThe vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows -