{"id":4205,"date":"2026-11-12T07:02:51","date_gmt":"2026-11-12T15:02:51","guid":{"rendered":"https:\/\/cyber.mag212.com\/qlik-sense-servers-reverse-shells-activemq-cve-2023-46604-veeam-cve-2024-40711-staged\/"},"modified":"2026-11-12T07:02:51","modified_gmt":"2026-11-12T15:02:51","slug":"qlik-sense-servers-reverse-shells-activemq-cve-2023-46604-veeam-cve-2024-40711-staged","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/qlik-sense-servers-reverse-shells-activemq-cve-2023-46604-veeam-cve-2024-40711-staged\/","title":{"rendered":"Qlik Sense Servers Used as a Staging Post: Reverse Shells, and Exploits for ActiveMQ and Veeam Waiting in the Wings"},"content":{"rendered":"\n

Business-intelligence servers rarely top anyone\u2019s patch list, and attackers know it. In October, Cynet saw Qlik Sense servers at several European organisations try to launch the same PowerShell reverse shell within a window of just over three minutes, each spawned by Qlik\u2019s own scheduler service. Cynet blocked the attempts. When its researchers followed the attacker\u2019s address, they found an open directory with a Go backdoor, SSH persistence scripts and exploits ready for Apache ActiveMQ and Veeam Backup & Replication.<\/p>\n\n\n\n

Researcher<\/strong><\/td>Cynet CyOps and Research<\/td><\/tr>
Seen<\/strong><\/td>October 2026 \u00b7 several EU customers in ~3 minutes<\/td><\/tr>
Infrastructure<\/strong><\/td>45.115.26[.]23 \u00b7 ports 4455, 4456, 8012<\/td><\/tr>
Next targets staged<\/strong><\/td>ActiveMQ CVE-2023-46604 \u00b7 Veeam CVE-2024-40711<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Reported]<\/strong> Cynet’s CyOps and research teams found Qlik Sense servers at several EU-based customers<\/strong> trying to launch PowerShell reverse shells to 45.115.26[.]23<\/code> in October, all within a window of just over three minutes. The initial command was Nishang’s one-line reverse shell, run under Qlik’s scheduler.exe<\/code>; Cynet blocked the spawn attempts. An open directory on the same IP held a Go backdoor, SSH persistence scripts, an Apache ActiveMQ CVE-2023-46604 exploit and a modified Veeam CVE-2024-40711 toolchain. (The Hacker News<\/a>) (Mallory<\/a>) Cynet has published its research; MAG212 found it but couldn’t open it, so the details come through the press. (Cynet<\/a>)<\/p>\n\n\n\n

\"Four-step
Figure 4 \u00b7 From Qlik’s scheduler to staged exploits.<\/strong> The reported chain, which Cynet blocked, and what sat in the attacker’s open directory. The Qlik entry flaw is unknown. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Who is affected and how it works<\/h2>\n\n\n\n

[Reported]<\/strong> Internet-facing Qlik Sense Enterprise for Windows servers. Which Qlik flaw was used isn’t known.<\/strong> The likely candidates are the 2023 trio: CVE-2023-41265 (HTTP tunnelling), CVE-2023-41266 (path traversal) and CVE-2023-48365 “DoubleQlik”, an incomplete fix for the first. The persistence script installs a legitimate OpenSSH package, sets sshd<\/code> to start automatically, opens inbound TCP 22, and runs C:\\ProgramData\\ssh\\winc.ps1<\/code> from a task named WinUpdCheck<\/strong> every five minutes. On Linux the Go backdoor reads \/etc\/shadow<\/code> and \/etc\/passwd<\/code> and looks for running ActiveMQ. (The Hacker News<\/a>) [MAG212 analysis]<\/strong> The scheduler.exe parent matches the 2023 CACTUS ransomware intrusions documented by Arctic Wolf, but nobody has attributed this activity. (Arctic Wolf (2023)<\/a>)<\/p>\n\n\n\n

Qlik host check<\/h3>\n\n\n\n

OS: Windows Server \u00b7 Shell: PowerShell 5.1 \u00b7 Privileges: local administrator \u00b7 READ-ONLY<\/em><\/p>\n\n\n\n

# Persistence artefacts named in the report\nGet-ScheduledTask -TaskName 'WinUpdCheck' -ErrorAction SilentlyContinue\nTest-Path 'C:\\ProgramData\\ssh\\winc.ps1'\nGet-Service sshd -ErrorAction SilentlyContinue\n# Connections to the reported C2\nGet-NetTCPConnection -RemoteAddress 45.115.26.23 -ErrorAction SilentlyContinue\n# Process-creation events with Qlik's scheduler as parent (needs 4688 auditing)\nGet-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 20000 -ErrorAction SilentlyContinue |\n  Where-Object { $_.Message -match 'Scheduler\\.exe' -and $_.Message -match 'powershell|cmd\\.exe' } |\n  Select-Object TimeCreated, Message<\/code><\/pre>\n\n\n\n
Expected clean result: no task, False<\/code>, no sshd service (unless you installed one), no connections, no events. Commands not tested by MAG212 CYBER.<\/strong> Indicators from The Hacker News<\/a>, citing Cynet<\/a>.<\/p>\n\n\n\n
Contain and remediate (in order)<\/h2>\n\n\n\n
    \n
  1. Take Qlik Sense off the internet<\/strong> or put it behind VPN or SSO; block 45.115.26[.]23<\/code>.<\/li>\n\n\n
  2. Patch Qlik Sense<\/strong> to a release that fixes all three 2023 CVEs (see Qlik’s support articles). (Qlik<\/a>)<\/li>\n\n\n
  3. Run the host check<\/strong>; on a hit, remove the task, script, sshd service and TCP 22 rule, rotate the Qlik service account and rebuild.<\/li>\n\n\n
  4. [MAG212 analysis]<\/strong> Check the next targets<\/strong>: ActiveMQ patched for CVE-2023-46604, Veeam Backup & Replication for CVE-2024-40711. Neither should be reachable from the Qlik server.<\/li>\n\n<\/ol>\n\n\n\n
    Verify recovery:<\/strong> Qlik build confirmed; no scheduler.exe-spawned shells for 7 days; ActiveMQ and Veeam versions checked. Prevention<\/strong> [MAG212 analysis]<\/strong>: three-year-old Qlik bugs are still paying off for attackers. Analytics servers are often forgotten in patch cycles, so add them to yours.<\/p>\n\n\n\n
    Why it matters<\/h2>\n\n\n\n
    The pattern mirrors the 2023 CACTUS ransomware campaign that broke in through unpatched Qlik Sense and then moved deeper. Staged exploits for a message broker and a backup server show where this operator wants to go next, and backup servers are exactly what ransomware crews disable before encrypting. The Qlik entry flaw is unknown, but three-year-old Qlik bugs are still exploitable on thousands of exposed servers.<\/p>\n\n\n\n
    The bottom line<\/h2>\n\n\n\n
    Take Qlik Sense off the open internet, patch it to a release that fixes the 2023 flaws, run the host check for the WinUpdCheck task and the OpenSSH backdoor, and confirm ActiveMQ and Veeam are patched and unreachable from the analytics tier.<\/p>\n\n\n\n
    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n
    \n\n\n\n
    This story is part of MAG212 CYBER Daily, 12 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
    Cynet blocked PowerShell reverse shells launched from Qlik Sense\u2019s scheduler at several EU organisations within three minutes. The attacker\u2019s open directory held a Go backdoor, SSH persistence and exploits for Apache ActiveMQ and Veeam Backup & Replication. Indicators, a host check and remediation.<\/p>","protected":false},"author":1,"featured_media":4191,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,15],"tags":[329,263,328,24,75,183],"class_list":["post-4205","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-incidents","category-threat-intelligence","tag-apache-activemq","tag-iocs","tag-qlik-sense","tag-ransomware","tag-threat-intelligence","tag-veeam"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4205"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4205\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4191"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}