Cynet Finds Reverse Shell Activity Targeting Qlik Sense Servers

Cynet’s CyOps and Research teams identified suspicious activity in October 2026 targeting Qlik Sense Enterprise for Windows servers, with attempts to deliver PowerShell reverse shell commands across several EU-based environments within a brief window of just over three minutes. The activity shows overlap with a November 2023 CACTUS-linked campaign that exploited then‑disclosed Qlik Sense flaws to gain initial access and stage payloads.

Three fixed CVEs from Qlik Sense, patched in August–September 2023, are cited in the report: CVE-2023-41265 (HTTP tunnelling and privilege escalation), CVE-2023-41266 (path traversal allowing unauthenticated sessions), and CVE-2023-48365 (unauthenticated RCE via HTTP header validation). The piece notes that CVE-2023-48365 is an incomplete fix for CVE-2023-41265 and that the November 2023 CACTUS activity involved loading tools such as UEMS, AnyDesk and Plink for persistence and remote control.

Evidence from Cynet points to a PowerShell one-liner reverse shell connecting to 45.115.26[.]23 on port 4455, with the operator later deploying a Windows Go reverse shell to 45.115.26.23:4456 and scanning for ActiveMQ processes. A separate exposed directory is said to host a Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified Veeam toolchain for CVE-2024-40711, suggesting a broader prepositioning effort.

Cynet asserts the backdoor also attempts to read /etc/shadow and /etc/passwd on Linux and, where SSH is available, can install OpenSSH and create a scheduled task to revive the reverse shell. The report states that attempts to spawn the reverse shell were blocked in testing.