Severity: Critical | Priority: 1
A threat actor is going after internet-facing Qlik Sense Enterprise servers. Several organisations were hit within a few minutes of each other in October 2026. The attackers get command execution through the Qlik Sense Scheduler service, the same pattern seen in the 2023 Cactus ransomware intrusions. The exact flaw used has not been confirmed, but the activity points to older, publicly known Qlik Sense vulnerabilities: the CVE-2023-41266 path traversal and CVE-2023-41265 request tunnelling, and the CVE-2023-48365 “DoubleQlik” bypass. Any Qlik Sense server in your network that is reachable from the internet and not fully patched should be treated as at risk.
After getting in, the attacker opens a PowerShell reverse shell and then installs a custom Go backdoor that can run on Windows and on a range of Linux architectures. Through the backdoor they profile the host and look for Apache ActiveMQ and remote-access services. For persistence, they install OpenSSH, add their own key to the administrators’ authorized keys, and create a scheduled task that reconnects the reverse shell every five minutes. Their staging server also holds exploits for Apache ActiveMQ (CVE-2023-46604) and Veeam Backup & Replication (CVE-2024-40711). This suggests a compromised Qlik server is being used as a foothold to reach other systems in the network, a typical step before ransomware is deployed.
Update Qlik Sense Enterprise for Windows to the latest patch release, and don’t expose the Qlik proxy or management console directly to the internet. If a server was exposed while unpatched, assume it may be compromised and check it for the following:
Because of the staged exploits, also make sure Apache ActiveMQ and Veeam Backup & Replication in your network are patched, and that their service ports can’t be reached from servers that don’t need them. If you confirm a compromise, isolate the host, remove the persistence, and rotate any credentials that were stored on or used from that server.