Hackers Target Qlik Sense Servers, Stage Exploits for ActiveMQ and Veeam
Threat actors are exploiting vulnerabilities in Qlik Sense servers, deploying reverse shells and staging exploits for ActiveMQ and Veeam, indicating a broader campaign.
Cybersecurity researchers have identified a concerning trend of threat actors targeting Qlik Sense servers, with observed attempts to deploy PowerShell reverse shells against multiple European customers in October 2026. These attacks, occurring within a narrow timeframe of just over three minutes, suggest a coordinated effort by malicious actors.
The activity bears similarities to a campaign documented in November 2023, where threat actors linked to the CACTUS ransomware operation likely weaponized newly disclosed flaws in Qlik Sense to gain initial access. The vulnerabilities in question, CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365, were patched by Qlik Sense in August and September 2023. These flaws, with CVSS scores up to 9.6, allowed for privilege escalation, path traversal, and unauthenticated remote code execution.
In the previous CACTUS campaign, attackers exploited these vulnerabilities to establish a foothold, download additional payloads, and deploy tools like ManageEngine UEMS, AnyDesk, and Plink for persistence and remote control. The recent activity, while not definitively linked to a specific vulnerability, involved the execution of a PowerShell command for a one-line reverse shell connecting to a known malicious IP address.
Although the attempts to spawn the reverse shell were blocked by security measures, testing revealed that the interactive communication channel is designed for reconnaissance and deploying a PowerShell script to establish persistence. This is achieved through a Windows Go reverse shell that connects to the attacker's infrastructure, subsequently searching for actively running processes related to Apache ActiveMQ and collecting system information on Linux systems.
A secondary PowerShell script variant aims to install OpenSSH and create a scheduled task for regular reverse shell execution. If the SSH daemon was unavailable, the script would download and install a legitimate OpenSSH package, configure it for automatic startup, and establish an inbound firewall rule for TCP port 22, indicating a multi-pronged approach to maintaining access.
Further analysis of the threat actor's infrastructure has uncovered a trove of malicious tools and exploits. This includes a custom Go backdoor for Windows, SSH persistence scripts, an exploit for ActiveMQ (CVE-2023-46604), and a modified Veeam toolchain for CVE-2024-40711. The presence of these diverse exploits suggests the threat actor is preparing for or actively conducting broader attacks beyond initial Qlik Sense compromise.
The combination of targeting a specific business intelligence platform like Qlik Sense, coupled with the staging of exploits for widely used infrastructure components like ActiveMQ and backup solutions like Veeam, highlights a sophisticated and multi-faceted threat. This campaign underscores the importance of timely patching of critical vulnerabilities and robust monitoring for unusual activity on enterprise servers.