# Qlik Sense Servers Targeted With PowerShell/Go Reverse Shells; ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Exploits Staged

> Cynet reported October 2026 attempts to deliver PowerShell reverse shells against several EU-based customers' Qlik Sense servers; Cynet blocked them. An exposed staging server (45.115.26.23:8012) held a custom Go backdoor, SSH persistence scripts, an ActiveMQ CVE-2023-46604 exploit and a modified public Veeam CVE-2024-40711 toolchain. The activity partly overlaps with the 2023 CACTUS-linked Qlik Sense intrusions documented by Arctic Wolf, but the initial-access vulnerability is unknown and the actor is unidentified.

- **Published:** 2026-11-11T14:52:14Z
- **Last reviewed:** 2026-11-11T14:52:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5775
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5775.png
- **ID:** TL-2026-5775
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (1 shown free below)
- **CVEs:** CVE-2023-41265, CVE-2023-41266, CVE-2023-48365, CVE-2023-46604, CVE-2024-40711

## Description

In October 2026 Cynet's CyOps and Research teams observed attempts against Qlik Sense servers at several EU-based customers. Within a window of just over three minutes, the targets saw a one-line PowerShell reverse shell, based on the public Nishang script Invoke-PowerShellTcpOneLine.ps1, connect to 45.115.26.23 on TCP/4455. The command ran under scheduler.exe (the Qlik Sense Scheduler service), which resembles the 2023 CACTUS Qlik intrusions. Cynet blocked these attempts. Cynet states that the exploit used for initial access is currently not known.

Cynet's testing of the staging infrastructure showed the PowerShell shell being used to deliver a Windows Go reverse shell that connects to 45.115.26.23:4456. The Go backdoor searches for running Apache ActiveMQ processes. On Linux it also collects system information and reads /etc/shadow and /etc/passwd. A persistence variant installs OpenSSH: if sshd is unavailable it downloads OpenSSH-Win64.zip from the staging server (a legitimate OpenSSH package reused by the operator), extracts it and runs install-sshd.ps1. It then sets sshd to start automatically, starts the service and adds an inbound firewall rule for TCP/22. It also creates a scheduled task named WinUpdCheck that launches a PowerShell reverse shell from C:\ProgramData\ssh\winc.ps1 every five minutes.

The same host exposes a directory listing on TCP/8012 containing the custom Go backdoor, SSH persistence scripts, an Apache ActiveMQ exploit for CVE-2023-46604 and a modified version of the public watchTowr Veeam CVE-2024-40711 toolchain. Cynet assesses that the operator may be preparing broader attacks. The Qlik Sense Enterprise for Windows flaws CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365 (DoubleQlik, an incomplete fix for CVE-2023-41265) were used by CACTUS operators in 2023 and are cited as context; they are not confirmed as the 2026 initial access vector.

Attribution is weak. The 2026 activity shares only some overlap with the November 2023 CACTUS campaign (Arctic Wolf), in which operators abused the Qlik Sense Scheduler to spawn processes and then deployed ManageEngine UEMS, AnyDesk and Plink, used an RDP tunnel, exfiltrated with rclone and deployed CACTUS ransomware. No file hashes were published for the 2026 activity. BeaconBeagle was queried for the C2 IP during research but returned HTTP 502, so no C2 correlation was obtained.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1543.003 Create or Modify System Process: Windows Service
- T1686 Disable or Modify System Firewall
- T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
- T1057 Process Discovery
- T1082 System Information Discovery
- T1021.004 Remote Services: SSH
- T1571 Non-Standard Port
- T1095 Non-Application Layer Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Qlik Sense Scheduler (scheduler.exe) Spawning PowerShell/cmd Reverse Shell — TL-2026-5775** (`TL-2026-5775-SPL-001`)

Detects the Qlik Sense Scheduler service (scheduler.exe) spawning PowerShell, pwsh or cmd.exe, the execution pattern seen in the October 2026 Cynet-observed attempts against EU Qlik Sense servers (Nishang Invoke-PowerShellTcpOneLine one-liner calling back to 45.115.26.23:4455) and in the 2023 CACTUS Qlik Sense intrusions (CVE-2023-41265 / CVE-2023-41266 / CVE-2023-48365). The Scheduler has no legitimate reason to launch an interactive shell, so the parent/child pairing is the primary signal; reverse-shell command-line markers raise confidence. Initial access vector for 2026 is unknown, so this rule is behaviour-first and exploit-agnostic.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.001
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*scheduler.exe" (Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*cmd.exe")
| eval reverse_shell_marker=if(match(CommandLine,"(?i)(TCPClient|GetStream|45[.]115[.]26[.]23|Invoke-PowerShellTcpOneLine|-enc|-EncodedCommand|DownloadString)"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users by host ParentImage Image reverse_shell_marker
| convert ctime(first_seen) ctime(last_seen)
| sort - reverse_shell_marker, - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "scheduler.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| extend ReverseShellMarker = ProcessCommandLine has_any ("TCPClient", "GetStream", "45.115.26.23", "Invoke-PowerShellTcpOneLine", "-EncodedCommand", "DownloadString")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReverseShellMarker
| order by Timestamp desc
```

### Sigma

```yaml
title: Qlik Sense Scheduler Spawning PowerShell or Command Shell
id: 3b7e1c52-8d4a-4f6e-9a21-5c0d7e8f1a01
status: experimental
description: Detects scheduler.exe (Qlik Sense Scheduler service) spawning powershell, pwsh or cmd, as seen in TL-2026-5775 (Nishang one-line reverse shell to 45.115.26.23:4455) and the 2023 CACTUS Qlik Sense intrusions.
references:
  - https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html
  - https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - cve.2023.41265
  - cve.2023.41266
  - cve.2023.48365
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\scheduler.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom Qlik Sense task scripts that deliberately invoke cmd.exe or PowerShell from the Scheduler
level: high
```

**Known false positives:**

- Qlik Sense administrators running custom task scripts that intentionally launch cmd.exe or PowerShell from the Scheduler service
- Qlik Sense upgrade or patching routines that invoke helper shell commands under scheduler.exe

**Tuning notes:** Restrict to Qlik Sense hosts via a host lookup or tag. Allowlist documented task-script command lines in the stats clause. Escalate immediately when reverse_shell_marker=yes or the host has any outbound connection to 45.115.26.23. Pair with TL-2026-5775-SPL-003 for C2 correlation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Service Spawning Shells or Download Utilities (locked: unlock with TL Creds)
- Rogue OpenSSH sshd Installation, Automatic Start and Inbound TCP/22 Firewall Rule (locked: unlock with TL Creds)
- Tool Staging Retrieval From [indicator]:8012 (Go Backdoor, SSH Scripts, Exploit Toolchains) (locked: unlock with TL Creds)
- Nishang Invoke-PowerShellTcpOneLine Reverse Shell via PowerShell Script Block Logging (locked: unlock with TL Creds)
- Linux Credential File Read and ActiveMQ Process/System Discovery by Go Backdoor (locked: unlock with TL Creds)
- Successful Inbound SSH Logon Against Windows OpenSSH Server (Rogue sshd Persistence Use) (locked: unlock with TL Creds)
- WinUpdCheck Scheduled Task and [indicator] Reverse-Shell Persistence (locked: unlock with TL Creds)
- Outbound C2 to [indicator] / TCP 4455-4456 With Beacon Interval Analysis (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 16)

Defanged, TLP:CLEAR.

- IP address: `45.115.26[.]23`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits (The Hacker News)](https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html)
- [CACTUS Ransomware Exploits Qlik Sense Vulnerabilities (The Hacker News, summarizing Arctic Wolf)](https://thehackernews.com/2023/11/cactus-ransomware-exploits-qlik-sense.html)
- [Arctic Wolf: Qlik Sense Exploited in CACTUS Ransomware Campaign](https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/)
- [Nishang Invoke-PowerShellTcpOneLine.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1)
- [watchTowr Labs CVE-2024-40711 PoC](https://github.com/watchtowrlabs/CVE-2024-40711)
- [watchTowr Labs: Veeam Backup & Response RCE (CVE-2024-40711)](https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/)
- [Veeam KB4649 advisory](https://www.veeam.com/kb4649)
- [NVD CVE-2024-40711](https://nvd.nist.gov/vuln/detail/CVE-2024-40711)
- [NVD CVE-2023-46604](https://nvd.nist.gov/vuln/detail/CVE-2023-46604)
- [NVD CVE-2023-48365](https://nvd.nist.gov/vuln/detail/CVE-2023-48365)
- [CISA KEV: Qlik Sense HTTP Tunneling (CVE-2023-48365)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365)
- [CISA KEV: Apache ActiveMQ Deserialization (CVE-2023-46604)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604)
- [CISA KEV: Veeam Backup & Replication (CVE-2024-40711)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711)
- [Qlik: Critical Security fixes for Qlik Sense Enterprise for Windows](https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801)
- [Praetorian: DoubleQlik - Bypassing the original fix for CVE-2023-41265](https://www.praetorian.com/blog/doubleqlik-bypassing-the-original-fix-for-cve-2023-41265/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5775