Qlik Sense Reverse-Shell Attempts Expose Attacker Tooling for ActiveMQ and Veeam

Threat actors targeted Qlik Sense servers at several European Union organizations in October 2026, attempting to launch PowerShell reverse shells that Cynet reported blocking. The activity resembled a November 2023 Qlik Sense intrusion campaign linked to CACTUS ransomware, but neither the current attackers nor the vulnerability used for initial access has been identified. Controlled testing revealed reconnaissance and persistence capabilities involving a Go backdoor, OpenSSH installation, and a scheduled PowerShell reverse shell; these findings do not establish that those capabilities were successfully deployed at affected organizations.

An exposed directory on the attackers’ infrastructure also contained exploit tooling for Apache ActiveMQ and Veeam vulnerabilities, indicating possible preparation for broader enterprise-software attacks—not confirmed exploitation of those products. Qlik previously issued critical fixes for Qlik Sense Enterprise for Windows vulnerabilities CVE-2023-41266 and CVE-2023-41265, but the available reporting does not establish their use in this activity. Defenders should verify Qlik Sense patch coverage and investigate unexpected PowerShell execution, OpenSSH installations, scheduled tasks, and unfamiliar Go executables on Qlik servers, while assessing patch coverage for ActiveMQ and Veeam deployments.