Security researchers at Cynet disclosed on November 11, 2026, that attackers targeted Qlik Sense Enterprise servers across several European organizations in October. The attacks occurred within approximately three minutes and caused the Qlik Sense Scheduler process to execute PowerShell reverse-shell commands. Cynet blocked the observed attempts before the reverse shells could establish connections, and no successful compromise was confirmed.
INITIAL ACCESS METHOD REMAINS UNCONFIRMED
The activity resembles earlier attacks associated with Cactus ransomware, although neither the initial access method nor the attackers’ identity has been confirmed. Investigators identified several previously exploited vulnerabilities associated with Qlik Sense and additional enterprise software:
- CVE-2023-41265 – Qlik Sense vulnerability associated with earlier exploitation campaigns.
- CVE-2023-41266 – Qlik Sense vulnerability linked to previous attacks.
- CVE-2023-48365 – Qlik Sense vulnerability previously exploited by ransomware operators.
- CVE-2023-46604 – Apache ActiveMQ remote code execution vulnerability.
- CVE-2024-40711 – Veeam Backup & Replication vulnerability associated with remote code execution.
ATTACK INFRASTRUCTURE REVEALS PERSISTENCE TOOLS
The attackers used infrastructure at 45.115.26[.]23 containing Windows and Linux backdoors, SSH persistence scripts, and exploit tools targeting ActiveMQ and Veeam. Their toolkit attempted to establish persistent access through OpenSSH, attacker-controlled SSH keys, and a scheduled task named WinUpdCheck that executed a PowerShell reverse shell every five minutes. Linux payloads also attempted to access credential-related files. Cynet did not confirm successful exploitation of ActiveMQ or Veeam systems.
WHAT DEFENDERS SHOULD DO
Organizations should immediately verify Qlik Sense security patches, restrict internet exposure, and investigate suspicious PowerShell activity launched by scheduler.exe. Security teams should monitor connections to 45.115.26[.]23, unexpected SSH installations, unauthorized firewall changes, and suspicious scheduled tasks. ActiveMQ and Veeam deployments should also be reviewed for vulnerable versions and indicators of compromise.