Loading story…
Threat actors have actively exploited internet-exposed Qlik Sense Enterprise for Windows servers using the critical vulnerabilities CVE-2023-41265, CVE-2023-41266, and potentially CVE-2023-48365 to obtain unauthenticated code execution and deploy Cactus ransomware. The activity affected organizations including several Dutch companies that had not applied security updates; Dutch authorities raised the threat assessment to High/High and urged immediate patching of exposed servers.
Following access, processes launched by the Qlik Sense Scheduler service (Scheduler.exe) executed PowerShell and command-shell activity to download remote-access and persistence tools, including renamed ManageEngine UEMS components, AnyDesk, and PuTTY/Plink. Operators disabled Sophos, changed local administrator passwords, established Plink RDP tunnels over port 443, moved laterally through RDP, and staged data with rclone—renamed svchost.exe—before deploying ransomware. Qlik issued security patches for the affected Qlik Sense Enterprise for Windows flaws in August and September 2023.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
A Dutch supplier of schoolbooks and digital educational materials was affected by Cactus ransomware earlier in the month referenced by the NCSC advisory.
The Dutch NCSC reported active ransomware-group exploitation of unpatched internet-connected Qlik Sense Enterprise servers, including against Dutch companies. The Digital Trust Center notified organizations with exposed servers, and the NCSC raised the vulnerabilities' threat rating to High/High.
During observed Qlik Sense compromises, attackers used Scheduler.exe to launch commands that installed or downloaded ManageEngine UEMS components, AnyDesk, and Plink; they also changed administrator passwords, used RDP for lateral movement, and in at least one case used renamed rclone for data exfiltration before ransomware deployment.
Arctic Wolf Labs observed a campaign in which a threat actor exploited publicly exposed Qlik Sense installations, using CVE-2023-41265 and CVE-2023-41266 and possibly CVE-2023-48365 for code execution and eventual Cactus ransomware deployment.
Qlik published an advisory covering critical security fixes for Qlik Sense Enterprise for Windows.
Qlik announced that new security patches were available for Qlik Sense Enterprise for Windows.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcearcticwolf.com
Open sourcecommunity.qlik.com
Open sourcecommunity.qlik.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch public-private partnership Project Melissa identified multiple Dutch organizations compromised by the **Cactus** ransomware group after attackers exploited internet-exposed, unpatched Qlik Sense Enterprise servers. The campaign, observed globally from late 2023 through March 2024, abused `CVE-2023-41265`, `CVE-2023-41266`, and `CVE-2023-48365`, which can enable unauthenticated takeover of affected Qlik Sense hosts. QlikTech had released updates for supported versions, but affected victims had not applied the latest patches. Attackers installed AnyDesk and Plink, changed administrator passwords, used RDP for lateral movement, and deployed ransomware. Project Melissa partners Fox-IT, Northwave, Responders, and ESET Nederland shared indicators in April and used internet scanning to identify exposed systems: roughly 5,200 Qlik Sense servers were internet-reachable worldwide, more than 3,100 were vulnerable, and 122 showed likely Cactus exploitation. The Dutch NCSC rated the threat **High/High**, while the Digital Trust Center, NCSC, DIVD, police, and international CSIRTs coordinated notifications; organizations should immediately patch exposed Qlik Sense servers and investigate for the published indicators of compromise.
Aug 31, 2026
Researchers reported that the **Agenda** ransomware operation, also tracked as **Qilin**, is conducting highly customized enterprise attacks across Asia and Africa and has now been linked to a victim in South Africa. A recent victim listing identified **Trends And Concepts** in South Africa, associated with the domain `www.trendsandconceptsinteriors.com`, as impacted by the Qilin group. Trend researchers said Agenda operators build victim-specific Go-based payloads that can include leaked account credentials, unique company identifiers, customized RSA keys, and ransom demands ranging from **$50,000 to $800,000**, with observed targeting of healthcare and education organizations in Indonesia, Saudi Arabia, South Africa, and Thailand. The intrusion methods described across the reports show a flexible and increasingly sophisticated playbook. In one case, attackers accessed a public-facing **Citrix** server using a valid account, moved laterally with **RDP** and leaked **Active Directory** credentials, scanned networks with **Nmap** and **Nping**, and deployed ransomware through **Group Policy** in under two days. A separate Trend investigation found Agenda actors using fake Google CAPTCHA pages to deliver credential stealers, then abusing legitimate remote-management tools including **ATERA**, **AnyDesk**, **ScreenConnect**, and **Splashtop**, while deploying **COROXY** SOCKS proxies, targeting **Veeam** backup infrastructure, and using **BYOVD** techniques with vulnerable drivers such as `eskle.sys`; the final ransomware payload was reportedly a Linux variant executed on Windows, likely through **Windows Subsystem for Linux**.
Aug 21, 2026
REvil affiliates exploited four zero-day flaws in on-premises **Kaseya VSA** servers to turn a trusted remote management platform into a ransomware delivery channel for managed service providers and their customers. The attack chain reportedly included an authentication bypass, unrestricted file upload, CSRF bypass, and command injection, allowing attackers to upload malicious ASP code and push ransomware through VSA with administrator-level access. Researchers said the campaign abused Kaseya-mandated antivirus exclusions, used `agentmon.exe` to launch malicious commands, decoded payloads with a renamed `certutil`, and side-loaded a malicious DLL through a signed dropper and an outdated Microsoft Defender binary while disabling multiple Defender protections. The supply-chain attack encrypted local, removable, and mapped network drives across downstream environments, affecting about **60 MSPs** and roughly **1,500 businesses**, though REvil claimed a far larger device count and demanded **$70 million** for a universal decryptor. Red Canary said it detected the activity before the vulnerabilities were publicly known by spotting behavioral indicators such as Defender tampering and registry changes tied to REvil, then used containment actions including endpoint isolation and hash banning across multiple customer environments. Kaseya later patched the flaws in version `9.5.7a` and subsequently obtained a universal decryptor from a trusted third party, which it distributed to victims as the FBI and DOJ continued investigating the incident.
Aug 15, 2026