Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.

Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes.

The activity has been found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense to obtain initial access to target environments.

The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows -

It's worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265.

In November 2023 CACTUS ransomware campaign, threat actors were observed exploiting the flaws to establish a foothold and download additional payloads to establish persistence and remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.

The latest activity detected by Cynet involves the use of a PowerShell command containing a one-line reverse shell that connects to "45.115.26[.]23" on port 4455. The exact vulnerability exploited to break into Qlik Sense servers is currently not known.

"The command was executed under scheduler.exe, resembling the 2023 Cactus Qlik intrusions," the cybersecurity company said.

Although attempts to spawn the reverse shell were blocked, Cynet's testing of the reverse shell in a controlled environment has revealed that the interactive communication channel is used to conduct reconnaissance and deliver a PowerShell script for enabling persistence.

Source link