Attackers went after Qlik Sense servers in October 2026, trying and failing to plant PowerShell reverse shells across several environments, according to Cynet's CyOps and Research teams.

The suspicious activity hit multiple E.U.-based customers within a window of just over three minutes. The exact vulnerability used to break in is not yet known.

The command ran under scheduler.exe, mirroring the 2023 CACTUS ransomware intrusions documented by Arctic Wolf, which likely weaponized then-newly-disclosed Qlik Sense flaws for initial access. Those bugs - CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365, the last known as DoubleQlik and an incomplete fix for the first - were patched in August and September 2023 and affect Qlik Sense Enterprise for Windows.

Cynet said the reverse shell attempts were blocked, but its controlled testing showed the channel is used for reconnaissance and to deliver a PowerShell script for persistence. That script relies on a Windows Go reverse shell connecting to 45.115.26[.]23 on port 4456, then hunts for running Apache ActiveMQ processes; on Linux it also gathers system information and reads /etc/shadow and /etc/passwd.

A second variant installs OpenSSH and creates a scheduled task called WinUpdCheck that launches a reverse shell at C:\ProgramData\ssh\winc.ps1 every five minutes. If sshd was unavailable, it pulled OpenSSH-Win64.zip from the staging server, installed it, set the service to start automatically and opened TCP 22 in the firewall.

Further analysis found an exposed directory at 45.115.26[.]23:8012 holding a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604 and a modified public Veeam toolchain for CVE-2024-40711 - signs the actor may be preparing for broader attacks.

Source: The Hackers News