Blocked in Three Minutes. The Next Attack Is Already Staged.

The whole attack lasted a little over three minutes. In October 2026, threat actors went after Qlik Sense servers at several European companies, trying to drop PowerShell reverse shells onto them. The shells never connected. The attempts were blocked before they could do anything. And yet the incident matters more than most successful breaches — because of what the attackers left behind for next time.

Cynet’s CyOps and Research teams spotted the activity. The targets were Qlik Sense servers — the analytics platform that sits at the center of many companies’ reporting, often internet-facing and holding credentials that open other doors. The attackers moved fast: the suspicious activity against several customers fit inside a window of just over three minutes. A three-minute window is designed to land before anyone reacts.

The shell that never connected

The attack started with one PowerShell command: a one-line reverse shell meant to connect back to 45.115.26.23 on port 4455. It ran under scheduler.exe — a detail that matters, because it matches how the CACTUS ransomware operation hit Qlik Sense servers in 2023. The exact vulnerability the attackers used to get in is still unknown.

Cynet tested the captured shell in a controlled environment to see what it was built to do. Once connected, the channel would let the attackers run reconnaissance and deliver a persistence script. That second stage is a Go-based reverse shell for Windows, connecting to the same server on port 4456. Once inside, it looks for processes related to Apache ActiveMQ — a clue about what the attackers want next. On Linux, the same tooling collects system information and reads /etc/shadow and /etc/passwd.

The persistence play

A second variant of the script shows how the attackers planned to stay. It installs OpenSSH on the target machine and creates a scheduled task called “WinUpdCheck” that launches a PowerShell reverse shell stored at C:\ProgramData\ssh\winc.ps1 every five minutes. If the SSH service is not available, the script downloads a copy of OpenSSH-Win64.zip from the staging server, extracts it, and runs the install script itself — setting it to start automatically and adding an inbound firewall rule for TCP port 22. The OpenSSH package is the legitimate one, reused by the operator. Nothing about the install looks malicious on its own: a normal service, a normal-sounding task name, and a shell that phones home every five minutes.

The staging server gives it away

Then Cynet found the staging server itself. An exposed directory on 45.115.26.23, port 8012, holds the attackers’ toolkit: a custom Go backdoor for Windows, scripts for SSH persistence, an exploit for the Apache ActiveMQ flaw CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711. None of that was used in the October attempts. It is the next attack, staged in advance.

ActiveMQ and Veeam are not Qlik Sense — they are the neighbors. An attacker staging exploits for three products on one server is building a kit that moves from one foothold to the next, using whichever door opens first.

This is the second act

Qlik Sense has been here before. In November 2023, Arctic Wolf documented a CACTUS ransomware campaign that used newly disclosed Qlik Sense flaws to break in: CVE-2023-41265, a 9.6-rated HTTP tunneling flaw that allowed privilege escalation; CVE-2023-41266, an 8.2 path traversal flaw that let an unauthenticated attacker create an anonymous session; and CVE-2023-48365, a 9.6 remote code execution flaw later nicknamed DoubleQlik — an incomplete fix for the first flaw. Qlik patched them in August and September 2023. The CACTUS operators used the access to drop ManageEngine UEMS, AnyDesk, and Plink for persistence and remote control.

The October 2026 activity overlaps with that campaign where it matters: the same product, the same scheduler.exe pattern, the same interest in persistence. Cynet has not attributed the new activity to CACTUS, and the initial-access flaw is still unidentified. But the playbook rhymes — and the staging server suggests whoever is running it intends to finish what the three-minute window started.

What to do about it

Start with the obvious: make sure your Qlik Sense servers actually carry the 2023 patches. The flaws are three years old and fixed — but only for servers that were updated. Check the version against Qlik’s advisories and close the gap now.

Then hunt for the fingerprints: PowerShell processes launched by scheduler.exe, a scheduled task named “WinUpdCheck” pointing at C:\ProgramData\ssh\winc.ps1, unexpected OpenSSH installs, and new inbound firewall rules on TCP 22. Block 45.115.26.23 at the firewall and in endpoint detection, including ports 4455, 4456, and 8012.

Finally, look beyond Qlik. Review your exposure to the two staged exploits — Apache ActiveMQ (CVE-2023-46604) and Veeam Backup & Replication (CVE-2024-40711) — and patch both. The attackers have already done the shopping.

A blocked attack is easy to file as a non-event. This one should not be. Three minutes of activity, a dead shell, and a staging server full of exploits is not a failed attack. It is a rehearsal.

Source: The Hacker News, based on research by Cynet, with background on the 2023 campaign from Arctic Wolf. For a related look at how trusted management tools become attack tools, see our earlier story on ScreenConnect being turned against the MSPs it serves, and the N-able disclosure that took a whole platform offline.