Attackers have gone back to Qlik Sense servers, firing near-identical PowerShell reverse shells at several European organisations within about three minutes. An exposed staging server shows the same operator also preparing exploits for Veeam backup software and Apache ActiveMQ.
What happened
On 11 November 2026 the security vendor Cynet published research from its CyOps and research teams describing a burst of malicious activity it detected in October against Qlik Sense Enterprise for Windows servers belonging to several customers in the EU. The same suspicious process chain appeared across separate customer estates in a little over three minutes, which suggests automated, scanner-driven targeting rather than a hand-picked intrusion.
In each case the Qlik scheduler process, scheduler.exe, launched a command shell and then PowerShell carrying a one-line reverse shell modelled on the Nishang toolkit. Cynet says its platform blocked execution, so the attacker never received an interactive session in those environments. Cynet has not named the victims or confirmed which vulnerability gave the attacker initial access.
What makes the story more than a blocked alert is what came next. Cynet’s analysts found that the attacker’s server, 45.115.26[.]23, exposed an open directory on port 8012. It held a custom backdoor written in Go with Windows and several Linux builds, persistence scripts, a legitimate OpenSSH package repurposed for remote access, and code to exploit a Veeam flaw, CVE-2024-40711, alongside an Apache ActiveMQ bug, CVE-2023-46604. The Veeam component is described as a modified version of a publicly available toolchain. Cynet saw no successful use of the ActiveMQ or Veeam exploits and believes that tooling was still being tested.
The technical picture
The parent process is the giveaway. Cynet notes that PowerShell running underneath scheduler.exe resembles the 2023 intrusions in which actors tied to the Cactus ransomware group likely broke into Qlik Sense servers, as documented at the time by Arctic Wolf. That campaign likely abused three Qlik flaws: CVE-2023-41266, a path traversal bug rated 8.2 that lets an unauthenticated user create an anonymous session; CVE-2023-41265, an HTTP tunnelling issue rated 9.6; and CVE-2023-48365, known as DoubleQlik, which exists because the first fix for CVE-2023-41265 was incomplete. Qlik shipped patches in August and September 2023, and its advisory still warns that it has received reports of malicious use.
The overlap with Cactus is behavioural, not a firm attribution. Cynet speaks of resemblance, and no group has been named.
To understand what a successful compromise would have looked like, Cynet ran the recovered payloads in a lab. The reverse shell on port 4455 was used to deliver a Go agent that called back on port 4456. That agent carried out host discovery and specifically checked for running ActiveMQ processes and ports. On Linux builds it also attempted to read /etc/passwd and /etc/shadow. A Bash agent associated with port 4457 was also recovered.
Persistence is where defenders have the best chance of catching a host that was not protected. One script checks whether the OpenSSH server is present, pulls the package from the staging server if not, installs and starts sshd, sets it to start automatically and opens inbound TCP 22 in the Windows firewall. The operator’s public key is written to the administrators_authorized_keys file under C:\ProgramData\ssh. Every five minutes a scheduled task named WinUpdCheck launches winc.ps1 from that same folder to restore the reverse shell, and the scripts attempt to create a wsvc service, displayed as “Windows Service Controller”, for a binary in C:\Windows\Temp.
The pattern is familiar: breach an exposed application server, hold on with legitimate tooling, then look for the next valuable system. Here that appears to be backup infrastructure and message brokers.
Why it matters for UK organisations
Qlik Sense is a common analytics platform in UK organisations, and analytics servers are often published to the internet so that partners or remote staff can reach dashboards. Those servers tend to sit outside the core patching rhythm because they are owned by a data or BI team rather than infrastructure. That is exactly why flaws patched three years ago are still worth an attacker’s time.
The Veeam angle is the bigger worry. Ransomware crews target backup platforms because destroying or encrypting backups removes the victim’s best route to recovery without paying. An operator who already holds a foothold on a BI server and has a working Veeam exploit ready is one lateral move away from that outcome. The NCSC’s ransomware guidance has long stressed keeping at least one offline or immutable backup, and this case is a reminder of why.
Although the victims Cynet saw were in the EU, scanning on this scale does not respect borders. Any UK organisation running an unpatched, exposed Qlik Sense instance should assume it has been probed.
Expert view
In my experience, BI platforms are one of the most consistently overlooked assets in external testing scopes. They are treated as business applications, so they rarely get the same scrutiny as VPNs or mail gateways, yet they run as privileged Windows services with access to sensitive data and service accounts.
The three-minute window suggests a list being worked through. Opportunistic attackers do not need a zero-day when n-day vulnerabilities in neglected systems still pay. What I find most useful in Cynet’s write-up is the persistence detail. A Windows server that suddenly has sshd installed, a new inbound rule on port 22 and an administrators_authorized_keys file is anomalous in almost every enterprise I have assessed. These are cheap, high-fidelity detections, and plenty of SOCs could write them today.
I would also caution against treating “blocked” as “closed”. Cynet’s customers had a control that stopped execution. Organisations without equivalent EDR coverage on their BI estate may not know whether the same commands ran successfully in October.
What to do now
- Find and patch Qlik Sense. Inventory every Qlik Sense Enterprise for Windows instance, confirm it carries the fixes for CVE-2023-41266, CVE-2023-41265 and CVE-2023-48365, and remove direct internet exposure where possible (Cyber Essentials: security update management, firewalls).
- Hunt on Qlik hosts. Search EDR and Windows event logs back to at least the start of October for scheduler.exe or other Qlik services spawning cmd.exe or PowerShell, especially hidden or no-profile invocations.
- Look for the persistence artefacts. Check for a WinUpdCheck scheduled task, a wsvc service, winc.ps1 under C:\ProgramData\ssh, unexpected sshd installations, new inbound TCP 22 firewall rules and unfamiliar keys in administrators_authorized_keys.
- Block and alert on the infrastructure. Add 45.115.26[.]23 to perimeter blocklists and alert on outbound connections to it on ports 80, 4455, 4456, 4457 and 8012. Load the file hashes and SSH key fingerprint from Cynet’s report into your tooling.
- Close the next hop. Verify Veeam Backup & Replication is patched for CVE-2024-40711 and ActiveMQ for CVE-2023-46604, segment backup servers from general server networks, and confirm you hold an offline or immutable backup copy.
- Review privileges. Ensure Qlik service accounts run with the least privilege needed and are not reused across systems (Cyber Essentials: user access control).
Bottom line
This is not a novel exploit, and that is the point. Attackers are still harvesting three-year-old Qlik flaws at speed and lining up backup systems as the next target. Patch the BI estate, hunt for the SSH-based persistence and make sure your backups cannot be reached from a compromised application server.
Sources
- Cynet: ZeroQlik Returns: Exploiting N-Days Still Pays Off
- The Hacker News: Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
- The IT Nerd: Cynet Uncovers Qlik Sense Attack Campaign Targeting Multiple Companies Within Minutes
- Qlik Community: Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265)
