Threat reportRansomwareTL-2026-3775
Cactus Ransomware Exploiting Qlik Sense Servers (CVE-2023-41266, CVE-2023-41265 'ZeroQlik', CVE-2023-48365 'DoubleQlik') - Fox-IT Victim Identification
Cactus Ransomware Exploiting Qlik Sense Servers (TL-2026-3775), also tracked as ZeroQlik, is a critical-severity ransomware operation scored CVSS 9.9, first published 2026-10-16. It is attributed to Cactus ransomware group with high confidence, affects Qlik Qlik Sense Enterprise for Windows, references 3 CVEs (CVE-2023-41266, CVE-2023-41265, CVE-2023-48365), maps to 12 MITRE ATT&CK techniques (T1021.001, T1033, T1036.005), and is covered by 9 detection rules and 14 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 1Cactus ransomware group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3775
- Threat ID
- TL-2026-3775
- Also known as
- ZeroQlik, DoubleQlik, Cactus Qlik Sense campaign
- Severity
- CRITICAL
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Cactus ransomware group
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- business-intelligence-analytics-users
- Target regions
- North America, Europe, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Cactus Ransomware Exploiting Qlik Sense Servers
Malware and tooling: AnyDesk, Cactus, AnyDesk, ManageEngine UEMS, Plink, Rclone - S1040, WizTree
How Cactus Ransomware Exploiting Qlik Sense Servers works
The Cactus ransomware group has exploited unpatched internet-facing Qlik Sense Enterprise for Windows servers for initial access since November 2023, chaining a path-traversal authentication bypass (CVE-2023-41266) with HTTP request tunneling (CVE-2023-41265, and its incomplete-fix bypass CVE-2023-48365). Fox-IT fingerprinted 5,205 exposed servers on 2024-04-17, found 3,143 (60%) vulnerable to DoubleQlik and 122 carrying compromise artifacts.
Qlik Sense Enterprise for Windows contains three chained flaws. CVE-2023-41266 (CWE-22) is a path-traversal flaw in the proxy: requests beginning with /resources/qmc/fonts/ and ending in .ttf skip authentication, and because the proxy does not normalize paths, '/../../../' sequences reach internal endpoints, letting an unauthenticated attacker obtain an anonymous session and call unauthorized endpoints. CVE-2023-41265 'ZeroQlik' (CWE-444) is an HTTP request-tunneling flaw: the proxy honors Content-Length while backend services honor Transfer-Encoding, so a second request can be smuggled to the repository service. This lets the attacker act as the internal sa_repository account (NVD CVSS 9.9). CVE-2023-48365 'DoubleQlik' (CWE-444) is an incomplete fix for CVE-2023-41265, discovered on 2023-09-20 and published 2023-11-15, that re-opens the same tunneling primitive.
Praetorian's public research (2023-08-31) shows how the chain reaches code execution. The attacker reaches /qrs/internal/management/apilogcontext/disable without authentication, tunnels a request as sa_repository, and creates an external program task through /qrs/externalprogramtask. The Qlik Scheduler service then runs arbitrary commands.
Arctic Wolf (late 2023) reported the first documented use of these flaws by Cactus ransomware operators for initial access. Reported post-exploitation includes: uninstalling Sophos security software, changing administrator passwords, deploying remote access software, using RDP and tunneling for lateral movement, and exfiltrating data. Tooling named in reporting is AnyDesk (downloaded from the official site), Plink renamed putty.exe, ManageEngine UEMS executables disguised as Qlik files, WizTree for disk-space analysis, and rclone renamed svchost.exe for upload to cloud storage. Execution used PowerShell, BITS and batch scripts.
Fox-IT's April 2024 research (campaign start: November 2023) provides victim-identification fingerprints. Cactus operators redirect command output into files in the Qlik fonts directory (Client/qmc/fonts/), e.g. 'whoami /all > ../Client/qmc/fonts/qle.ttf' and 'quser > ../Client/qmc/fonts/qle.ttf', and also use qle.woff. These files are not part of a default installation, so their presence indicates compromise regardless of current patch level. Fox-IT identified servers via product-info.json release labels (retrieved unauthenticated using the '?.ttf' trick), compiled candidates from Censys and Google BigQuery, and treated a response of 'HTTP/1.1 302 Authenticate at this location' as likely patched against CVE-2023-48365. On 2024-04-17 it counted 5,205 servers, 3,143 vulnerable and 122 compromised. Top vulnerable countries were US (396), Italy (280), Brazil (244), Netherlands (241) and Germany (175). Top compromised countries were US (49), Spain (13), Italy (11), UK (8) and Germany (7). The Dutch Institute for Vulnerability Disclosure (DIVD) notified affected administrators.
CISA added CVE-2023-41265 and CVE-2023-41266 to the KEV catalog on 2023-12-07 and CVE-2023-48365 on 2025-01-13. NVD scores are 9.9 (CVE-2023-41265), 9.9 (CVE-2023-48365) and 6.5 (CVE-2023-41266). Severity is set to CRITICAL because of the 9.9 scores, KEV listing and ransomware use; the hunt skeleton's HIGH was a provisional analyst judgment made without a CVSS score. The sources publish no network IOCs (no C2 IPs or domains), so there was nothing to check against BeaconBeagle.
MITRE ATT&CK techniques used in TL-2026-3775
Lateral Movement
T1021.001 Remote Desktop Protocol
Discovery
T1033 System Owner/User Discovery
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1197 BITS Jobs
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Command and Control
T1219.002 Remote Desktop Software; T1572 Protocol Tunneling
Exfiltration
T1567.002 Exfiltration to Cloud Storage
defense-impairment
Affected products and versions in Cactus Ransomware Exploiting Qlik Sense Servers
- Qlik — Qlik Sense Enterprise for Windows
Vulnerable versions: August 2022 through Patch 12; November 2022 through Patch 10; February 2023 through Patch 7; May 2023 through Patch 3; August 2023 through Patch 1 (CVE-2023-48365)
Fixed in: August 2023 Patch 2 and later; May 2023 Patch 6; February 2023 Patch 10; November 2022 Patch 11 (CVE-2023-41265/41266 fix); August 2022 Patch 13 (CVE-2023-41265/41266 fix)
Remediation for Cactus Ransomware Exploiting Qlik Sense Servers
Patches
- Upgrade Qlik Sense Enterprise for Windows to August 2023 Patch 2 or later (May 2023 Patch 6, February 2023 Patch 10 or later in older release lines) to cover CVE-2023-48365 as well as CVE-2023-41265 and CVE-2023-41266
Immediate actions
- Hunt Qlik Sense servers for qle.ttf and qle.woff (and any non-default files) in Client/qmc/fonts/ and treat any hit as a confirmed compromise
- Remove Qlik Sense management/proxy interfaces from direct internet exposure
- Review the QRS for unexpected external program tasks and for tasks created via /qrs/externalprogramtask
- Hunt for AnyDesk, Plink (putty.exe), rclone (svchost.exe), WizTree and ManageEngine UEMS binaries outside expected paths, and for BITS jobs on Qlik hosts
- Reset administrator credentials on any compromised host and audit RDP lateral-movement logons
Workarounds
- Restrict access to Qlik Sense proxy and QMC to trusted networks or VPN until patched
- Apply a WAF or reverse-proxy rule to block /resources/qmc/fonts/ requests containing '../' sequences and requests carrying both Content-Length and Transfer-Encoding headers
Longer-term hardening
- Maintain asset inventory and external attack-surface monitoring for Qlik Sense
- Deploy EDR with tamper protection to prevent security software from being uninstalled
- Alert on web server or Qlik service processes spawning cmd.exe or PowerShell
CVEs associated with Cactus Ransomware Exploiting Qlik Sense Servers
Weaknesses (CWE) in Cactus Ransomware Exploiting Qlik Sense Servers
Timeline of Cactus Ransomware Exploiting Qlik Sense Servers
- Qlik publishes its security advisory and NVD publishes CVE-2023-41265 (HTTP tunneling) and CVE-2023-41266 (path traversal) for Qlik Sense Enterprise for Windows
- Praetorian publicly discloses the ZeroQlik exploit chain (path traversal plus HTTP tunneling to create an external program task)
- Qlik advisory update on a bypass of the CVE-2023-41265 fix, later tracked as CVE-2023-48365 (DoubleQlik)
- NVD publishes CVE-2023-48365 (DoubleQlik), the incomplete-fix bypass of CVE-2023-41265, CVSS 9.9
- Help Net Security covers Arctic Wolf's report of the first documented Cactus ransomware intrusions using the three Qlik Sense flaws for initial access. Fox-IT places the campaign start in November 2023, and the original Arctic Wolf publication date is not confirmed here
- CISA adds CVE-2023-41265 and CVE-2023-41266 to the Known Exploited Vulnerabilities catalog (action due 2023-12-28)
- Fox-IT counts 5,205 internet-exposed Qlik Sense servers: 3,143 (60%) vulnerable to DoubleQlik and 122 showing compromise artifacts (qle.ttf/qle.woff)
- Fox-IT publishes 'Sifting through the spines' with fingerprinting method and indicators; DIVD notifies affected administrators
- CISA adds CVE-2023-48365 to the Known Exploited Vulnerabilities catalog (action due 2025-02-03)
Sources cited for Cactus Ransomware Exploiting Qlik Sense Servers
- Sifting through the spines: identifying (potential) Cactus ransomware victims
- Arctic Wolf Security Bulletin: CVE-2023-41265, CVE-2023-41266, CVE-2023-48365
- Cactus ransomware exploiting Qlik Sense flaws to breach networks
- Qlik Sense flaws exploited in Cactus ransomware campaign
- Qlik Sense vulnerabilities exploited in ransomware attacks
- Praetorian: ZeroQlik technical exploit analysis
- Qlik Security Advisory: Critical Security fixes for Qlik Sense Enterprise for Windows
- NVD: CVE-2023-41266
- NVD: CVE-2023-41265
- NVD: CVE-2023-48365
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-3775
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3775 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.