Top Highlights
- Attackers targeted Qlik Sense servers in Europe with PowerShell reverse-shell commands; the exact entry vulnerability is unknown.
- The blocked shell could enable reconnaissance and persistence, including scheduled reverse shells and OpenSSH installation with inbound SSH access.
- Exposed attacker infrastructure contained an ActiveMQ exploit, a Veeam exploit toolchain, and a Go backdoor—signs of preparation for broader attacks.
Threat, Techniques, and Targets
Activity: In October 2026, Cynet identified suspicious activity against several E.U. customers. The activity occurred within a window of just over three minutes and targeted Qlik Sense servers. Cynet linked some techniques to a 2023 campaign associated with CACTUS ransomware, but it has not confirmed the group behind this activity.
Techniques: The actors tried to run a PowerShell reverse shell that connected to 45.115.26[.]23 on port 4455. Cynet’s defenses blocked the attempts. However, testing in a controlled environment showed that a related backdoor could support reconnaissance and persistence. The scripts also searched for Apache ActiveMQ processes, attempted to collect Linux system information, and tried to read account files. Another script installed OpenSSH and created a scheduled task called WinUpdCheck to run a reverse shell every five minutes.
The actor’s exposed server also held an ActiveMQ exploit for CVE 2023 46604 and a modified Veeam toolchain for CVE 2024 40711. This suggests preparation for possible broader attacks, but the source does not confirm that the actor used these tools against victims. Cynet has not identified the exact flaw used to access Qlik Sense servers.
Impact, Security Implications, and Remediation
Impact and risk: The blocked attempts limited the reported activity. Still, successful access could let an attacker gather system information, establish persistence, and maintain remote access. The scripts also show efforts to inspect systems that run ActiveMQ and to access sensitive Linux account files.
Remediation: Qlik patched the cited Qlik Sense vulnerabilities in August and September 2023. Therefore, organizations should check their Qlik Sense versions and apply the relevant vendor updates. They should also review systems for unexpected PowerShell activity, the WinUpdCheck task, unfamiliar OpenSSH services, and connections to 45.115.26[.]23. The source provides no complete incident response procedure. For version specific fixes and recovery steps, consult Qlik and relevant cybersecurity authorities.
Stay Ahead with the Latest Tech Trends
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
