Cactus Ransomware Exploits Exposed Qlik Sense Servers for Double Extortion

Cactus ransomware operators exploited unpatched, internet-facing Qlik Sense servers to gain access, steal data, and encrypt victim networks. Arctic Wolf linked observed intrusions to likely exploitation of CVE-2023-41266, CVE-2023-41265, or CVE-2023-48365, depending on patch levels. Northwave investigated two incidents involving ZeroQlik and/or DoubleQlik vulnerabilities that culminated in ransomware deployment on January 23 and April 3, 2024. Attackers established persistence using legitimate remote-management tools and, in some cases, remained inactive for months before proceeding. Reporting indicated that thousands of servers remained exposed to CVE-2023-48365 as of April 17, 2024.

Observed activity included unusual processes spawned by the Qlik Sense Scheduler service, deployment of ManageEngine UEMS, AnyDesk, and PuTTY Link, RDP tunneling and lateral movement, and Rclone-based data exfiltration. Attackers also removed Sophos protection, changed administrator credentials, and deleted Volume Shadow Copies to hinder recovery. Arctic Wolf disrupted several intrusions early, while backup policies substantially supported recovery in both Northwave cases. Collaboration through project Melissa helped identify and notify owners of vulnerable and compromised Qlik Sense instances worldwide. Defenders should prioritize patching and restricting external access to Qlik Sense, investigate unexpected Scheduler child processes and remote-access tools, and validate backups; patching alone does not remove persistence from previously compromised servers.