--- id: "CMP-202611-wy6jem" page: "https://infrastack.ai/live/CMP-202611-wy6jem" kind: "campaign" aliases: [] title: "Attackers exploit old Qlik Sense flaws to open PowerShell reverse shells on servers at EU firms, and stage ActiveMQ and Veeam exploits next (Cynet)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Qlik Sense Enterprise for Windows", "fixed": [], "ecosystem": "vendor"}, {"name": "Apache ActiveMQ", "fixed": [], "ecosystem": "vendor"}, {"name": "Veeam Backup & Replication", "fixed": [], "ecosystem": "vendor"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-11T15:22:17+00:00" updated_at: "2026-11-11T15:24:17+00:00" sources: [{"source": "analyst", "url": "https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/", "first_seen_at": "2026-11-11T15:22:17+00:00", "cites": ["https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/"]}] exploit_sources: [] --- # ZeroQlik: Attackers exploit old Qlik Sense flaws to open PowerShell reverse shells on servers at EU firms, and stage ActiveMQ and Veeam exploits next (Cynet) Link for people: https://infrastack.ai/live/CMP-202611-wy6jem (this .md is for agents) In October 2026 Cynet saw the same attack hit Qlik Sense Enterprise for Windows servers at several EU customers in just over three minutes. Qlik's Scheduler.exe launched cmd.exe and then a hidden PowerShell reverse shell back to 45.115.26.23:4455. The pattern matches the 2023 Cactus ransomware intrusions, which most likely used CVE-2023-41266 with CVE-2023-41265, or CVE-2023-48365 (DoubleQlik). Cynet blocked the shells at its customers. The attacker's open directory (45.115.26.23:8012) held a Go reverse-shell agent (wsvc.exe) for Windows and Linux, SSH persistence scripts, ActiveMQ CVE-2023-46604 payloads and a modified Veeam CVE-2024-40711 exploit kit. The ActiveMQ and Veeam tools look like they are still being tested, and no successful ActiveMQ or Veeam break-in was seen. The attacker also looked for SmarterMail folders. The actor is unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Qlik Sense Enterprise for Windows affected range not listed fixed no fixed version listed - vendor:Apache ActiveMQ affected range not listed fixed no fixed version listed - vendor:Veeam Backup & Replication affected range not listed fixed no fixed version listed ## Cause How the attacker got in: a known vulnerability left unpatched (unpatched-vuln). The record says the pattern 'matches the 2023 Cactus ransomware intrusions, which most likely used CVE-2023-41266 with CVE-2023-41265, or CVE-2023-48365', so the entry is a probable but unconfirmed known vulnerability in Qlik Sense, and the intrusions ran on victim servers without reaching their users or dependents. How it reached others: it stayed inside (none). So it does not happen to you: Your board lists the advisories that are in range for your stack, with the fix version. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unpatched-vuln ## How to check Look for Qlik Sense Scheduler.exe spawning cmd.exe /c powershell -nop -w hidden -enc. Look for traffic to 45.115.26.23 on ports 80 (/hb?), 4455, 4456 or 8012. Files to look for: C:\Windows\Temp\wsvc.exe, a service named wsvc with display name 'Windows Service Controller', C:\ProgramData\ssh\winc.ps1, and a scheduled task WinUpdCheck that runs every 5 minutes. Check C:\ProgramData\ssh\administrators_authorized_keys for the key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINXERAciMEWq3c3EUn/ThtV3httVyRK72UNcxy9YFpNy node6-sm. Also look for new sshd installs with an inbound TCP 22 firewall rule. persist.ps1 SHA256: 24ee79a519839230377585ec541863b1615286736cbeb98125afeb82d91bb768 and 1ff457d643e5246efb04861169153402345d50b0bb296443b93a87790909efd5. The Go agent's banner is 'AGENT windows/amd64'. ## Fix Patch Qlik Sense Enterprise for Windows to a release that fixes CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365, and take Qlik Sense off the open internet. Patch ActiveMQ for CVE-2023-46604 and Veeam Backup & Replication for CVE-2024-40711. Block 45.115.26.23. Any Qlik server that matches the indicators is compromised: remove the SSH key, the WinUpdCheck task and the wsvc service, then rotate the credentials stored on that server. ## Timeline - 2026-11-11T15:22:17+00:00 analyst https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/ ## Documents - [describes] r/netsec: Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits https://www.reddit.com/r/netsec/comments/1xtjslt/qlik_sense_servers_hit_with_powershell_reverse/ - [describes] ZeroQlik Returns: Qlik Sense Exploitation (Cynet Research) https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/ --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_