Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits

Threat actors have been targeting Qlik Sense servers since October 2026 in an unsuccessful attempt to deploy PowerShell reverse shell commands across multiple environments. Cynet's CyOps and Research teams identified the suspicious activity within a three-minute window against several EU-based customers. This campaign shares similarities with a November 2023 operation linked to the CACTUS ransomware group, which exploited newly discovered vulnerabilities in Qlik Sense Enterprise for Windows.

The vulnerabilities, patched in August and September 2023, include CVE-2023-48365 and CVE-2023-41265. In the latest attack, a PowerShell command with a one-line reverse shell connects to 45.115.26[.]23 on port 4455. Although blocked attempts were made, Cynet's testing revealed that the reverse shell is used for reconnaissance and delivering a PowerShell script for persistence.

This backdoor connects to 45.115.26[.]23:4456 and searches for ActiveMQ processes on Linux systems, reading sensitive files like /etc/shadow and /etc/passwd.

A second PowerShell script variant attempts to install OpenSSH, create a scheduled task, and launch the reverse shell at five-minute intervals. If sshd is unavailable, it downloads OpenSSH-Win64.zip, extracts it, and runs install-sshd.ps1. The infrastructure also reveals an exposed directory containing a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified Veeam toolchain for CVE-2024-40711. This suggests the threat actor may be preparing for more extensive attacks.