"The command was executed under scheduler.exe, resembling the 2023 Cactus Qlik intrusions," Cynet wrote, summarizing a short, concentrated intrusion attempt observed in October 2026.
Cynet's October 2026 detections
Cynet's CyOps and Research teams identified attempts to deliver one-line PowerShell reverse shells against Qlik Sense servers in October 2026. The activity hit several E.U.-based customers and unfolded within a narrow window of just over three minutes. Although the reverse-shell attempts were blocked in the wild, Cynet recreated and analyzed the payloads in a controlled environment to understand operator intent and follow-on activity.
Qlik Sense vulnerabilities tied to prior CACTUS activity
The recent activity shares overlap with a November 2023 campaign documented by Arctic Wolf, in which operators linked to the CACTUS ransomware operation exploited newly disclosed Qlik Sense flaws to gain initial access. The relevant vulnerabilities — all affecting Qlik Sense Enterprise for Windows and patched by Qlik in August and September 2023 — are:
- CVE-2023-41265 (CVSS score: 9.6) — an HTTP tunneling vulnerability that can lead to privilege escalation and permit execution of HTTP requests on the backend server hosting the repository application.
- CVE-2023-41266 (CVSS score: 8.2) — a path traversal vulnerability allowing an unauthenticated remote attacker to generate an anonymous session and perform HTTP requests to unauthorized endpoints.
- CVE-2023-48365 (CVSS score: 9.6) — an unauthenticated remote code execution vulnerability stemming from improper validation of HTTP headers that lets an attacker tunnel HTTP requests and execute requests on the backend server.
Cynet noted that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265. In the November 2023 CACTUS campaign, operators exploited these flaws to establish footholds and then download additional tooling — including ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink — to establish persistence and remote control.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageThe reverse shells and persistence techniques observed
Cynet's analysis details multiple variants and stages. The initial PowerShell command observed in October 2026 contained a one-line reverse shell that attempted to connect to 45.115.26[.]23 on port 4455. When Cynet executed the payloads in a lab, the interactive channel delivered a PowerShell script designed to enable persistence.
That follow-on component used a Windows Go-based reverse shell that connected to 45.115.26[.]23:4456. The backdoor probed for actively running processes related to Apache ActiveMQ on Windows systems. On Linux targets, the malware attempted to collect system information and read /etc/shadow and /etc/passwd.
A second PowerShell variant attempted to install OpenSSH and created a scheduled task named "WinUpdCheck" that launched a PowerShell reverse shell written to C:\ProgramData\ssh\winc.ps1 at five-minute intervals. According to Cynet: "If sshd remained unavailable, it downloaded OpenSSH-Win64.zip from the staging server, extracted it, and ran install-sshd.ps1." The actor set sshd to automatic startup, started the service, and added an inbound firewall rule for TCP 22. Cynet added that the archive was a legitimate OpenSSH package reused by the operator.
Importantly, the exact vulnerability used to break into the Qlik Sense servers in the October 2026 attempts is currently not known.
Exposed staging infrastructure: ActiveMQ exploit and modified Veeam toolchain
Further analysis of the attacker's infrastructure uncovered an exposed directory at 45.115.26[.]23:8012 containing several items that indicate broader staging activity. The directory included:
- a custom Go backdoor for Windows;
- SSH persistence scripts;
- an ActiveMQ exploit for CVE-2023-46604;
- a modified public Veeam toolchain for CVE-2024-40711.
Those files suggest the operator was assembling multiple exploitation and persistence options — including targeting messaging middleware (ActiveMQ) and backup tooling (Veeam) — possibly to extend reach or to prepare for follow-on compromise.
What this means for technologists, EU-based enterprises, and incident responders
- Technologists and security teams: The observed behavior shows a mix of one-line reverse shells, Go-based backdoors, and legitimate third-party binaries (OpenSSH) reused for persistence. Teams should watch for scheduled tasks named "WinUpdCheck," unexpected sshd installations on Windows hosts, and connections to 45.115.26[.]23 on ports 4455 and 4456.
- EU-based enterprises: Cynet's detections targeted several E.U.-based customers in a compact timeframe, underlining how quickly a short-lived intrusion window can attempt to scale. Enterprises using Qlik Sense Enterprise for Windows and related middleware should verify patch status for the listed CVEs and hunt for indicators matching the described behavior.
- Incident responders: The presence of an exposed staging directory hosting an ActiveMQ exploit (CVE-2023-46604) and a modified Veeam toolchain for CVE-2024-40711 indicates an operator prepared to pivot beyond Qlik Sense. Responders should treat recoverable artifacts from the October 2026 attempts as potentially part of a multi-stage campaign.
The record from Cynet is clear on intent: short, automated reverse-shell attempts that — when allowed to run — download backdoors, hunt for ActiveMQ processes, and install persistent remote access via OpenSSH. What remains unanswered in the published details is which vulnerability or chain of vulnerabilities yielded initial access in October 2026. The exposed staging server and the reuse of known CVEs suggest an operator laying groundwork for broader attacks; whether they will succeed depends on defenders' ability to detect and block the precise exploitation vectors in play.
