As reported by The Hacker News, threat actors have resumed targeting Qlik Sense servers in a campaign bearing striking resemblance to the November 2023 CACTUS ransomware intrusions documented by Arctic Wolf. While the October 2026 attempts observed by Cynet were blocked, the attack chain — PowerShell reverse shells executed via scheduler.exe and follow-on staging against Apache ActiveMQ and Veeam — signals a deliberate, multi-platform escalation path that defenders cannot afford to ignore.

Security Impact: As reported by The Hacker News, threat actors have resumed targeting Qlik Sense servers in a campaign bearing striking resemblance to the November 2023 CACTUS ransomware intrusions documented by Arctic Wolf.

Why This Matters

The most alarming signal here isn't the initial access vector — it's the downstream targeting. After establishing a foothold via Qlik Sense, the attackers actively scanned for Apache ActiveMQ processes and prepared to leverage Veeam exploitation. This mirrors a well-documented ransomware affiliate pattern: compromise an edge application, enumerate the internal environment, then pivot to backup infrastructure to prevent recovery. The fact that the reverse shell connected to a hardcoded IP (45.115.26[.]23) on ports 4455/4456 suggests either a low-sophistication operator or a deliberate choice to maintain simplicity — both scenarios are dangerous in different ways.

The three-year-old CVEs being leveraged (CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365) remain unpatched in a significant number of deployments. CVE-2023-48365 — an incomplete fix for CVE-2023-41265 — is particularly notable because it demonstrates the persistent challenge of properly remediating HTTP tunneling vulnerabilities in complex application architectures.

Vulnerability Details

CVECVSSSeverityTypeProductPatched
CVE-2023-412659.6CriticalHTTP Tunneling / Privilege EscalationQlik Sense Enterprise for WindowsAug 2023
CVE-2023-412668.2HighPath Traversal / Unauth SessionQlik Sense Enterprise for WindowsSep 2023
CVE-2023-483659.6CriticalUnauth RCE (incomplete fix)Qlik Sense Enterprise for WindowsNov 2023

Who Is at Risk

Vulnerability Details
Primary exposure: Organizations running Qlik Sense Enterprise for Windows versions patched before November 2023
Heightened risk: EU-based enterprises (current campaign targeting), though the CVEs are not geographically limited
Critical risk multiplier: Environments with exposed Apache ActiveMQ instances or Veeam backup infrastructure reachable from the Qlik host
Deployment patterns at risk: Qlik Sense servers exposed to the internet without WAF/reverse proxy filtering

Active Exploitation Status

Active exploitation confirmed. Cynet observed attempted (blocked) intrusions in October 2026 against multiple EU customers within a narrow three-minute window, indicating automated or coordinated scanning. The activity overlaps with CACTUS ransomware TTPs from November 2023.

Immediate Actions

  • Patch immediately: Upgrade Qlik Sense Enterprise for Windows to the latest version. If running anything patched before November 2023, treat as critically exposed.
  • Network segmentation: Qlik Sense servers should never be internet-exposed. Place behind a reverse proxy or VPN. Restrict scheduler.exe outbound connectivity.
  • IOC blocking: Block 45.115.26[.]23 at perimeter, EDR, and DNS resolver levels. Monitor for outbound connections to ports 4455 and 4456.
  • Detection rules: Alert on PowerShell execution spawned by scheduler.exe, especially with encoded commands or reverse shell patterns (Net.Sockets.TCPClient, cmd.exe pipe redirection).
  • Backup hardening: Isolate Veeam backup servers from the general internal network. Verify Veeam is fully patched — attackers are clearly staging for this pivot.
  • ActiveMQ audit: Inventory all Apache ActiveMQ instances reachable from Qlik-hosting network segments. Patch or isolate immediately.

Shield53 Recommendations

Beyond the immediate patching imperative, this campaign underscores a persistent problem: edge application CVEs from 2023 are still delivering initial access in 2026. Organizations should: (1) conduct a full inventory of all externally facing applications and cross-reference against CISA KEV; (2) implement application allow-listing for child processes of service accounts — scheduler.exe should not spawn powershell.exe; (3) enforce network microsegmentation so that compromise of a BI/analytics platform cannot reach backup infrastructure; (4) validate that EDR coverage extends to all Qlik Sense hosts, including detection for living-off-the-land PowerShell reverse shells.

The three-minute attack window Cynet observed suggests reconnaissance and exploitation are largely automated. Human response speed is insufficient — automated containment and isolation of Qlik hosts on anomalous behavior must be in place before the next campaign variant arrives.