Ethical Hacking News
Hackers recently exploited vulnerabilities in Qlik Sense servers, leveraging ActiveMQ and Veeam vulnerabilities to conduct reconnaissance and deliver persistence. This attack highlights the importance of staying vigilant and proactive in cybersecurity. Organizations must ensure that their software is up-to-date and that their systems are patched against known vulnerabilities. By taking proactive measures, organizations can reduce their risk of being targeted by these types of attacks.
The new threat targets Qlik Sense servers with reverse shells, leveraging vulnerabilities in ActiveMQ and Veeam. The vulnerabilities were patched by Qlik Sense in August and September 2023, but one vulnerability, CVE-2023-48365, is still exploitable. The threat actor uses a PowerShell command with a one-line reverse shell to connect to a server, and attempts to conduct reconnaissance and deliver persistence. The malware also attempts to collect system information, read sensitive files, and install OpenSSH. The threat actor is laying the groundwork for broader attacks, with exposed directories containing custom Go backdoors and exploits for other vulnerabilities.
In the realm of cybersecurity, threats are constantly evolving, and organizations must stay vigilant to protect themselves from the ever-growing list of vulnerabilities. Recently, a new threat has emerged, targeting Qlik Sense servers with reverse shells, and leveraging vulnerabilities in ActiveMQ and Veeam. This article aims to provide an in-depth look at the threat actors, the vulnerabilities exploited, and the potential consequences of this attack.
In October 2026, Cynet's CyOps and Research teams detected suspicious activity against several E.U.-based customers of Qlik Sense servers. The activity was found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf, in which threat actors linked to the CACTUS ransomware operation likely weaponized newly-disclosed flaws in Qlik Sense to obtain initial access to target environments. This highlights the ongoing cat-and-mouse game between threat actors and cybersecurity professionals, as each side seeks to exploit vulnerabilities and gain an upper hand.
The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows. Specifically, the vulnerabilities include:
1. CVE-2023-41265 (CVSS score: 9.6) - An HTTP tunneling vulnerability that could lead to privilege escalation and allow an attacker to execute HTTP requests on the backend server hosting the repository application.
2. CVE-2023-41266 (CVSS score: 8.2) - A path traversal vulnerability that could allow an unauthenticated remote attacker to generate an anonymous session and perform HTTP requests to unauthorized endpoints.
3. CVE-2023-48365 (CVSS score: 9.6) - An unauthenticated remote code execution vulnerability that stems from improper validation of HTTP headers, allowing an attacker to elevate their privilege by tunneling HTTP requests and execute HTTP requests on the backend server.
It is worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265. This highlights the importance of keeping software up-to-date, as even patching one vulnerability may leave other vulnerabilities open to exploitation.
The latest activity detected by Cynet involves the use of a PowerShell command containing a one-line reverse shell that connects to 45.115.26[.]23 on port 4455. The exact vulnerability exploited to break into Qlik Sense servers is currently not known. The command was executed under scheduler.exe, resembling the 2023 Cactus Qlik intrusions.
Although attempts to spawn the reverse shell were blocked, Cynet's testing of the reverse shell in a controlled environment has revealed that the interactive communication channel is used to conduct reconnaissance and deliver a PowerShell script for enabling persistence. This is achieved by means of a Windows Go reverse shell that connects to 45.115.26[.]23:4456. The backdoor is then used to look for actively running processes related to Apache ActiveMQ. On Linux, the malware also attempts to collect system information and read "/etc/shadow" and "/etc/passwd" files.
A second variant of the PowerShell script attempts to install OpenSSH and creates a scheduled task named "WinUpdCheck" that launches a PowerShell reverse shell written to "C:\ProgramData\ssh\winc.ps1" at five-minute intervals. If sshd remained unavailable, it downloaded OpenSSH-Win64.zip from the staging server, extracted it, and ran install-sshd.ps1. It set sshd to automatic startup, started the service, and added an inbound firewall rule for TCP 22. The archive was a legitimate OpenSSH package reused by the operator.
Further analysis of the infrastructure has uncovered an exposed directory ("45.115.26[.]23:8012") consisting of a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711. This indicates that the threat actor is possibly laying the groundwork for broader attacks.
The recent attack on Qlik Sense servers highlights the importance of staying vigilant and proactive in cybersecurity. Organizations must ensure that their software is up-to-date, and that their systems are patched against known vulnerabilities. Additionally, it is crucial to implement robust security measures, such as monitoring and logging, to detect and respond to potential threats in a timely manner.
In conclusion, the recent threat actors targeting Qlik Sense servers with reverse shells, and leveraging vulnerabilities in ActiveMQ and Veeam, underscore the need for cybersecurity professionals to stay informed and up-to-date on the latest threats and vulnerabilities. By taking proactive measures to patch software, implement robust security measures, and stay vigilant, organizations can reduce their risk of being targeted by these types of attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Exploit-Qlik-Sense-Servers-and-Leverage-ActiveMQ-and-Veeam-Vulnerabilities-ehn.shtml
https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html
Published: Wed Nov 11 10:17:56 2026 by llama3.2 3B Q4_K_M
