Kyles Investigation is a Tennessee Licensed Private Investigator #5411.
SUBMIT A JOB

Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits

Qlik Sense today, ActiveMQ and Veeam tomorrow. Attackers aren’t just dropping reverse shells—they’re staging exploit kits for adjacent infrastructure. Here’s what security teams need to look for right now.

By Mark Kyle November 11, 2026

Security firm Cynet has reported attempts to run PowerShell reverse shells on Qlik Sense servers at several European organizations. The attempts were blocked, but the attacker’s infrastructure contained tooling for other enterprise software, which suggests broader plans.

What Cynet saw

Cynet’s CyOps and Research teams detected the activity in October 2026 against several E.U.-based customers, all within a window of just over three minutes. The attackers ran a one-line PowerShell reverse shell under scheduler.exe, the Qlik Sense Scheduler process. It connected to 45.115.26[.]23 on port 4455.

Cynet doesn’t know how the attackers got in. The use of scheduler.exe resembles intrusions from a November 2023 campaign that Arctic Wolf linked to the CACTUS ransomware operation. In that campaign, attackers exploited three Qlik Sense Enterprise for Windows flaws: CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365. Cynet describes only an overlap, and it hasn’t attributed this activity to CACTUS or any other group.

How the attack worked

Because the live attempts were blocked, Cynet reproduced the behavior in a controlled environment:

  1. Initial shell. The PowerShell one-liner opens an interactive channel back to the attacker.
  2. Discovery and persistence. The channel is used for reconnaissance and to deliver a persistence script. One path drops a Go-based Windows reverse shell that connects to the same IP on port 4456. It looks for running Apache ActiveMQ processes. On Linux, the malware also tries to collect system information and read /etc/passwd and /etc/shadow.
  3. OpenSSH variant. A second script version installs OpenSSH if it isn’t already present. It sets the service to start automatically and opens an inbound firewall rule for TCP 22. It also creates a scheduled task called “WinUpdCheck” that runs a PowerShell reverse shell from C:\ProgramData\ssh\winc.ps1 every five minutes.

An exposed staging server

Cynet also found an open directory on 45.115.26[.]23:8012. It held a custom Windows Go backdoor, SSH persistence scripts, an exploit for Apache ActiveMQ (CVE-2023-46604), and a modified public toolchain for a Veeam flaw (CVE-2024-40711). Cynet says this suggests the operator may be preparing broader attacks. It doesn’t show that any particular campaign is imminent.

What defenders should do

  • Patch Qlik Sense. Apply the fixes in Qlik’s security advisories for all three CVEs. CVE-2023-48365 (DoubleQlik) was an incomplete fix for CVE-2023-41265, so confirm your version is covered by the later advisory, not just the first one.
  • Hunt for persistence. Look for a scheduled task named WinUpdCheck, unexpected OpenSSH installs, new inbound TCP 22 firewall rules, and C:\ProgramData\ssh\winc.ps1.
  • Watch outbound traffic. Flag PowerShell connections to unfamiliar IPs, especially on non-standard ports like 4455 and 4456. Block the indicators above.
  • Patch adjacent systems. Make sure Apache ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) are updated, and check that Qlik Sense and these services aren’t needlessly exposed to the internet.

Sources:

Leave a Reply