{"id":"CMP-202611-wy6jem","kind":"campaign","aliases":[],"related":[],"title":"Attackers exploit old Qlik Sense flaws to open PowerShell reverse shells on servers at EU firms, and stage ActiveMQ and Veeam exploits next (Cynet)","description":null,"summary":"In October 2026 Cynet saw the same attack hit Qlik Sense Enterprise for Windows servers at several EU customers in just over three minutes. Qlik's Scheduler.exe launched cmd.exe and then a hidden PowerShell reverse shell back to 45.115.26.23:4455. The pattern matches the 2023 Cactus ransomware intrusions, which most likely used CVE-2023-41266 with CVE-2023-41265, or CVE-2023-48365 (DoubleQlik). Cynet blocked the shells at its customers. The attacker's open directory (45.115.26.23:8012) held a Go reverse-shell agent (wsvc.exe) for Windows and Linux, SSH persistence scripts, ActiveMQ CVE-2023-46604 payloads and a modified Veeam CVE-2024-40711 exploit kit. The ActiveMQ and Veeam tools look like they are still being tested, and no successful ActiveMQ or Veeam break-in was seen. The attacker also looked for SmarterMail folders. The actor is unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-11T15:22:17+00:00","products":[{"name":"Qlik Sense Enterprise for Windows","fixed":[],"ecosystem":"vendor"},{"name":"Apache ActiveMQ","fixed":[],"ecosystem":"vendor"},{"name":"Veeam Backup & Replication","fixed":[],"ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for Qlik Sense Scheduler.exe spawning cmd.exe /c powershell -nop -w hidden -enc. Look for traffic to 45.115.26.23 on ports 80 (/hb?), 4455, 4456 or 8012. Files to look for: C:\\Windows\\Temp\\wsvc.exe, a service named wsvc with display name 'Windows Service Controller', C:\\ProgramData\\ssh\\winc.ps1, and a scheduled task WinUpdCheck that runs every 5 minutes. Check C:\\ProgramData\\ssh\\administrators_authorized_keys for the key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINXERAciMEWq3c3EUn/ThtV3httVyRK72UNcxy9YFpNy node6-sm. Also look for new sshd installs with an inbound TCP 22 firewall rule. persist.ps1 SHA256: 24ee79a519839230377585ec541863b1615286736cbeb98125afeb82d91bb768 and 1ff457d643e5246efb04861169153402345d50b0bb296443b93a87790909efd5. The Go agent's banner is 'AGENT windows/amd64'.","fix":"Patch Qlik Sense Enterprise for Windows to a release that fixes CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365, and take Qlik Sense off the open internet. Patch ActiveMQ for CVE-2023-46604 and Veeam Backup & Replication for CVE-2024-40711. Block 45.115.26.23. Any Qlik server that matches the indicators is compromised: remove the SSH key, the WinUpdCheck task and the wsvc service, then rotate the credentials stored on that server.","status":"open","published_at":null,"first_seen_at":"2026-11-11T15:22:17+00:00","triaged_at":"2026-11-11T15:22:17+00:00","updated_at":"2026-11-11T15:24:17+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-11T15:27:38Z","path":"none","entry":"unpatched-vuln","reason":"The record says the pattern 'matches the 2023 Cactus ransomware intrusions, which most likely used CVE-2023-41266 with CVE-2023-41265, or CVE-2023-48365', so the entry is a probable but unconfirmed known vulnerability in Qlik Sense, and the intrusions ran on victim servers without reaching their users or dependents.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-2023':95B,99B,103B,137B '-2024':145B '-202611':26A '-40711':146B '-41265':100B '-41266':96B '-46604':138B '-48365':104B '2023':86B '2026':44B '4455':81B '45.115.26.23':80B,118B '8012':119B 'activemq':19A,34A,135B,150B,164B 'actor':180B 'agent':126B 'also':174B 'apache':33A 'attack':1A,49B,114B,173B 'back':78B 'backup':36A 'block':107B 'break':168B 'break-in':167B 'cactus':87B 'campaign':38B 'cmd.exe':70B 'cmp':25A 'custom':60B,112B 'cve':94B,98B,102B,136B,144B 'cynet':24A,45B,106B 'directori':117B 'doubleqlik':105B 'earli':40B 'early-warn':39B 'enterpris':53B 'enterprise':30A 'eu':15A,59B 'exploit':2A,22A,147B 'firm':16A 'flaw':6A 'folder':178B 'for':31A 'go':122B 'held':120B 'hidden':74B 'hit':50B 'intrus':89B 'kit':148B 'launch':69B 'like':92B,155B 'linux':131B 'look':154B,175B 'match':84B 'minut':65B 'modifi':142B 'next':23A 'octob':43B 'old':3A 'open':8A,116B 'pattern':83B 'payload':139B 'persist':133B 'powershel':9A,75B 'qlik':4A,28A,51B,66B 'ransomwar':88B 'replication':37A 'revers':10A,76B,124B 'reverse-shel':123B 'saw':46B 'scheduler.exe':68B 'script':134B 'seen':171B 'sens':5A,52B 'sense':29A 'server':13A,56B 'sever':58B 'shell':11A,77B,109B,125B 'smartermail':177B 'ssh':132B 'stage':18A 'still':158B 'success':163B 'test':160B 'three':64B 'tool':153B 'unknown':182B 'use':93B 'veeam':21A,35A,143B,152B,166B 'warn':41B 'window':55B,129B 'windows':32A 'wsvc.exe':127B 'wy6jem':27A","nicknames":["ZeroQlik"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["activemq","apacheactivemq","backupreplication","qliksenseenterpriseforwindows","senseenterpriseforwindows","veeambackupreplication","zeroqlik"],"ptokens":["activemq","apache","backup","enterprise","for","qlik","replication","sense","veeam","windows"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"exploitation","search_a":"'-202611':26A 'activemq':19A,34A 'apache':33A 'attack':1A 'backup':36A 'cmp':25A 'cynet':24A 'enterprise':30A 'eu':15A 'exploit':2A,22A 'firm':16A 'flaw':6A 'for':31A 'next':23A 'old':3A 'open':8A 'powershel':9A 'qlik':4A,28A 'replication':37A 'revers':10A 'sens':5A 'sense':29A 'server':13A 'shell':11A 'stage':18A 'veeam':21A,35A 'windows':32A 'wy6jem':27A","search_b":"'-2023':95B,99B,103B,137B '-2024':145B '-40711':146B '-41265':100B '-41266':96B '-46604':138B '-48365':104B '2023':86B '2026':44B '4455':81B '45.115.26.23':80B,118B '8012':119B 'activemq':135B,150B,164B 'actor':180B 'agent':126B 'also':174B 'attack':49B,114B,173B 'back':78B 'block':107B 'break':168B 'break-in':167B 'cactus':87B 'campaign':38B 'cmd.exe':70B 'custom':60B,112B 'cve':94B,98B,102B,136B,144B 'cynet':45B,106B 'directori':117B 'doubleqlik':105B 'earli':40B 'early-warn':39B 'enterpris':53B 'eu':59B 'exploit':147B 'folder':178B 'go':122B 'held':120B 'hidden':74B 'hit':50B 'intrus':89B 'kit':148B 'launch':69B 'like':92B,155B 'linux':131B 'look':154B,175B 'match':84B 'minut':65B 'modifi':142B 'octob':43B 'open':116B 'pattern':83B 'payload':139B 'persist':133B 'powershel':75B 'qlik':51B,66B 'ransomwar':88B 'revers':76B,124B 'reverse-shel':123B 'saw':46B 'scheduler.exe':68B 'script':134B 'seen':171B 'sens':52B 'server':56B 'sever':58B 'shell':77B,109B,125B 'smartermail':177B 'ssh':132B 'still':158B 'success':163B 'test':160B 'three':64B 'tool':153B 'unknown':182B 'use':93B 'veeam':143B,152B,166B 'warn':41B 'window':55B,129B 'wsvc.exe':127B","search_c":"","cause_entry":"unpatched-vuln","cause_path":"none","disclosures_checked_at":null,"first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-wy6jem","url":"https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T15:22:17+00:00","fetched_at":"2026-11-11T15:22:17+00:00","note":null,"cites":["https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/"]}],"documents":[{"id":126381,"url":"https://www.reddit.com/r/netsec/comments/1xtjslt/qlik_sense_servers_hit_with_powershell_reverse/","title":"r/netsec: Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits","kind":"post","source":"reddit","publisher":null,"text":"Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits\n\nsubmitted by /u/Much-Television-9449 [link] [comments]","published_at":"2026-11-11T14:55:07+00:00","relation":"describes","confidence":null,"note":null},{"id":126478,"url":"https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/","title":"ZeroQlik Returns: Qlik Sense Exploitation (Cynet Research)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":"2026-11-11T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}