Attackers target Qlik Sense servers with reverse shells and exploit tools
Threat actors targeted Qlik Sense servers in October 2026 with PowerShell reverse shells, according to Cynet's CyOps and Research teams. The activity affected several EU-based customers within a period of just over three minutes. Cynet said the attempts to start the reverse shell were blocked.
The current intrusion path is not established. Cynet said the exact vulnerability used to break into the Qlik Sense servers is unknown. The command ran under scheduler.exe, which Cynet said resembled activity from a 2023 campaign associated with the CACTUS ransomware operation.
In its controlled testing, Cynet found that the reverse shell provided an interactive channel for reconnaissance and for delivering a PowerShell script intended to establish persistence. A second script attempted to install OpenSSH, create a scheduled task named WinUpdCheck and run a reverse shell from C:\ProgramData\ssh\winc.ps1 every five minutes.
The script also configured the OpenSSH service for automatic startup and added an inbound firewall rule for TCP port 22, according to Cynet. On Linux, the malware attempted to collect system information and read the /etc/shadow and /etc/passwd files. The evidence does not say that these actions succeeded on the targeted systems.
The activity overlaps with a November 2023 campaign in which attackers exploited Qlik Sense flaws to gain an initial foothold and deploy tools for persistence and remote control. Qlik Sense patched the relevant vulnerabilities in August and September 2023, according to the report. They affect Qlik Sense Enterprise for Windows and include CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365.
Cynet also found an exposed directory containing a Windows Go backdoor, SSH persistence scripts, an exploit for Apache ActiveMQ's CVE-2023-46604 and a modified Veeam toolchain for CVE-2024-40711. Cynet said this indicates the actor may be preparing broader attacks, but the evidence does not establish that those additional tools were used against Qlik Sense customers.