# Cactus Ransomware Exploiting Qlik Sense Servers (CVE-2023-41266, CVE-2023-41265 'ZeroQlik', CVE-2023-48365 'DoubleQlik') - Fox-IT Victim Identification

> The Cactus ransomware group has exploited unpatched internet-facing Qlik Sense Enterprise for Windows servers for initial access since November 2023, chaining a path-traversal authentication bypass (CVE-2023-41266) with HTTP request tunneling (CVE-2023-41265, and its incomplete-fix bypass CVE-2023-48365). Fox-IT fingerprinted 5,205 exposed servers on 2024-04-17, found 3,143 (60%) vulnerable to DoubleQlik and 122 carrying compromise artifacts.

- **Published:** 2026-10-16T20:54:08Z
- **Last reviewed:** 2026-10-16T20:54:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3775
- **ID:** TL-2026-3775
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Cactus ransomware group
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-41266, CVE-2023-41265, CVE-2023-48365

## Description

Qlik Sense Enterprise for Windows contains three chained flaws. CVE-2023-41266 (CWE-22) is a path-traversal flaw in the proxy: requests beginning with /resources/qmc/fonts/ and ending in .ttf skip authentication, and because the proxy does not normalize paths, '/../../../' sequences reach internal endpoints, letting an unauthenticated attacker obtain an anonymous session and call unauthorized endpoints. CVE-2023-41265 'ZeroQlik' (CWE-444) is an HTTP request-tunneling flaw: the proxy honors Content-Length while backend services honor Transfer-Encoding, so a second request can be smuggled to the repository service. This lets the attacker act as the internal sa_repository account (NVD CVSS 9.9). CVE-2023-48365 'DoubleQlik' (CWE-444) is an incomplete fix for CVE-2023-41265, discovered on 2023-09-20 and published 2023-11-15, that re-opens the same tunneling primitive.

Praetorian's public research (2023-08-31) shows how the chain reaches code execution. The attacker reaches /qrs/internal/management/apilogcontext/disable without authentication, tunnels a request as sa_repository, and creates an external program task through /qrs/externalprogramtask. The Qlik Scheduler service then runs arbitrary commands.

Arctic Wolf (late 2023) reported the first documented use of these flaws by Cactus ransomware operators for initial access. Reported post-exploitation includes: uninstalling Sophos security software, changing administrator passwords, deploying remote access software, using RDP and tunneling for lateral movement, and exfiltrating data. Tooling named in reporting is AnyDesk (downloaded from the official site), Plink renamed putty.exe, ManageEngine UEMS executables disguised as Qlik files, WizTree for disk-space analysis, and rclone renamed svchost.exe for upload to cloud storage. Execution used PowerShell, BITS and batch scripts.

Fox-IT's April 2024 research (campaign start: November 2023) provides victim-identification fingerprints. Cactus operators redirect command output into files in the Qlik fonts directory (Client/qmc/fonts/), e.g. 'whoami /all > ../Client/qmc/fonts/qle.ttf' and 'quser > ../Client/qmc/fonts/qle.ttf', and also use qle.woff. These files are not part of a default installation, so their presence indicates compromise regardless of current patch level. Fox-IT identified servers via product-info.json release labels (retrieved unauthenticated using the '?.ttf' trick), compiled candidates from Censys and Google BigQuery, and treated a response of 'HTTP/1.1 302 Authenticate at this location' as likely patched against CVE-2023-48365. On 2024-04-17 it counted 5,205 servers, 3,143 vulnerable and 122 compromised. Top vulnerable countries were US (396), Italy (280), Brazil (244), Netherlands (241) and Germany (175). Top compromised countries were US (49), Spain (13), Italy (11), UK (8) and Germany (7). The Dutch Institute for Vulnerability Disclosure (DIVD) notified affected administrators.

CISA added CVE-2023-41265 and CVE-2023-41266 to the KEV catalog on 2023-12-07 and CVE-2023-48365 on 2025-01-13. NVD scores are 9.9 (CVE-2023-41265), 9.9 (CVE-2023-48365) and 6.5 (CVE-2023-41266). Severity is set to CRITICAL because of the 9.9 scores, KEV listing and ransomware use; the hunt skeleton's HIGH was a provisional analyst judgment made without a CVSS score. The sources publish no network IOCs (no C2 IPs or domains), so there was nothing to check against BeaconBeagle.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1098 Account Manipulation
- T1197 BITS Jobs
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1033 System Owner/User Discovery
- T1021.001 Remote Desktop Protocol
- T1219.002 Remote Desktop Software
- T1572 Protocol Tunneling
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [Sifting through the spines: identifying (potential) Cactus ransomware victims](https://blog.fox-it.com/2024/04/25/sifting-through-the-spines-identifying-potential-cactus-ransomware-victims/)
- [Arctic Wolf Security Bulletin: CVE-2023-41265, CVE-2023-41266, CVE-2023-48365](https://arcticwolf.com/resources/blog/cve-2023-41265-cve-2023-41266-cve-2023-48365/)
- [Cactus ransomware exploiting Qlik Sense flaws to breach networks](https://www.bleepingcomputer.com/news/security/cactus-ransomware-exploiting-qlik-sense-flaws-to-breach-networks/)
- [Qlik Sense flaws exploited in Cactus ransomware campaign](https://www.helpnetsecurity.com/2023/12/01/qlik-sense-cactus-ransomware/)
- [Qlik Sense vulnerabilities exploited in ransomware attacks](https://www.securityweek.com/qlik-sense-vulnerabilities-exploited-in-ransomware-attacks/)
- [Praetorian: ZeroQlik technical exploit analysis](https://www.praetorian.com/blog/qlik-sense-technical-exploit/)
- [Qlik Security Advisory: Critical Security fixes for Qlik Sense Enterprise for Windows](https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801)
- [NVD: CVE-2023-41266](https://nvd.nist.gov/vuln/detail/CVE-2023-41266)
- [NVD: CVE-2023-41265](https://nvd.nist.gov/vuln/detail/CVE-2023-41265)
- [NVD: CVE-2023-48365](https://nvd.nist.gov/vuln/detail/CVE-2023-48365)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3775