Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits

Cynet researchers report that threat actors targeted multiple EU-based Qlik Sense server environments in October 2026, attempting to launch PowerShell-based reverse shell commands within a tight three-minute window. While the attempted shells were blocked, the activity closely mirrors tactics used in a November 2023 campaign tied to the CACTUS ransomware group, which abused Qlik Sense Enterprise for Windows flaws CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365 (patched in 2023) to gain initial access. The exact entry vulnerability used in this new wave remains unconfirmed, but testing showed the reverse shell channel was used for reconnaissance and to deploy a persistence script, along with a Go-based backdoor that hunts for ActiveMQ processes and, on Linux, reads /etc/shadow and /etc/passwd. Investigators also found an exposed attacker-controlled server hosting a custom Windows Go backdoor, SSH persistence scripts, an exploit for the ActiveMQ flaw CVE-2023-46604, and a modified public exploit toolchain for the Veeam vulnerability CVE-2024-40711 — suggesting the operators may be preparing for wider follow-on attacks.