Qlik Sense Servers Targeted with Reverse Shell Attacks in October 2026 Campaign

Qlik Sense servers were targeted in October 2026 with attempts to install reverse shells, according to analysis published on 11 November 2026. The activity affected multiple customers based in the European Union within a window of just over three minutes, although all attempts were successfully blocked.

A reverse shell is a technique in which the compromised machine initiates an outbound connection back to the attacker’s server instead of waiting for an inbound connection. This approach often bypasses firewall rules that inspect only incoming traffic. In the observed incidents, the command arrived as a single line of PowerShell executed via the Qlik Sense scheduling component.

The underlying vulnerability used to reach the servers has not been identified. However, the execution method closely matches a November 2023 campaign attributed to operators of the CACTUS ransomware. That earlier operation exploited three vulnerabilities in Qlik Sense Enterprise for Windows that were patched between August and September 2023: CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365. The third patch only partially addressed the first issue.

In the 2023 campaign, attackers used initial access to deploy legitimate remote administration tools for persistence. The reuse of the same scheduling component in the 2026 attempts links the two events, although researchers describe the connection as similarity rather than confirmed attribution to the same group.

Reproduction of the reverse shell in a controlled environment revealed an interactive channel used for reconnaissance and delivery of a second-stage implant written in Go. This component searches for Apache ActiveMQ processes on the compromised host. On Linux systems it collects system information and attempts to read files containing local account hashes. One variant installs the Windows OpenSSH server and creates a scheduled task that triggers the remote channel every five minutes. When the service is absent, the official OpenSSH package is downloaded from attacker infrastructure, installed, set to auto-start, and allowed through the firewall.

The infrastructure associated with the operation included a publicly accessible directory containing the Go implant, SSH persistence scripts, an exploit for a 2023 Apache ActiveMQ vulnerability, and a modified public tool targeting a 2024 Veeam Backup and Replication flaw. The collection of tools suggests preparation for attacks against additional products beyond Qlik Sense.