MAG212 CYBER ORIGINAL ARTICLE

Qlik Sense Servers Used as a Staging Post: Reverse Shells, and Exploits for ActiveMQ and Veeam Waiting in the Wings

November 12, 2026 · El Mostafa Ouchen

MAG212 CYBER illustration: a business-intelligence dashboard with a red command-line tunnel leading out, headline 'Analytics servers as a launch pad'.

Business-intelligence servers rarely top anyone’s patch list, and attackers know it. In October, Cynet saw Qlik Sense servers at several European organisations try to launch the same PowerShell reverse shell within a window of just over three minutes, each spawned by Qlik’s own scheduler service. Cynet blocked the attempts. When its researchers followed the attacker’s address, they found an open directory with a Go backdoor, SSH persistence scripts and exploits ready for Apache ActiveMQ and Veeam Backup & Replication.

ResearcherCynet CyOps and Research
SeenOctober 2026 · several EU customers in ~3 minutes
Infrastructure45.115.26[.]23 · ports 4455, 4456, 8012
Next targets stagedActiveMQ CVE-2023-46604 · Veeam CVE-2024-40711

What happened

[Reported] Cynet’s CyOps and research teams found Qlik Sense servers at several EU-based customers trying to launch PowerShell reverse shells to 45.115.26[.]23 in October, all within a window of just over three minutes. The initial command was Nishang’s one-line reverse shell, run under Qlik’s scheduler.exe; Cynet blocked the spawn attempts. An open directory on the same IP held a Go backdoor, SSH persistence scripts, an Apache ActiveMQ CVE-2023-46604 exploit and a modified Veeam CVE-2024-40711 toolchain. (The Hacker News) (Mallory) Cynet has published its research; MAG212 found it but couldn’t open it, so the details come through the press. (Cynet)

Four-step chain from a Qlik Sense server through scheduler.exe and a reverse shell to OpenSSH persistence; below, a Go backdoor and ActiveMQ and Veeam exploits staged on the same IP.
Figure 4 · From Qlik’s scheduler to staged exploits. The reported chain, which Cynet blocked, and what sat in the attacker’s open directory. The Qlik entry flaw is unknown. Diagram: MAG212 CYBER

Who is affected and how it works

[Reported] Internet-facing Qlik Sense Enterprise for Windows servers. Which Qlik flaw was used isn’t known. The likely candidates are the 2023 trio: CVE-2023-41265 (HTTP tunnelling), CVE-2023-41266 (path traversal) and CVE-2023-48365 “DoubleQlik”, an incomplete fix for the first. The persistence script installs a legitimate OpenSSH package, sets sshd to start automatically, opens inbound TCP 22, and runs C:\ProgramData\ssh\winc.ps1 from a task named WinUpdCheck every five minutes. On Linux the Go backdoor reads /etc/shadow and /etc/passwd and looks for running ActiveMQ. (The Hacker News) [MAG212 analysis] The scheduler.exe parent matches the 2023 CACTUS ransomware intrusions documented by Arctic Wolf, but nobody has attributed this activity. (Arctic Wolf (2023))

Qlik host check

OS: Windows Server · Shell: PowerShell 5.1 · Privileges: local administrator · READ-ONLY

# Persistence artefacts named in the report
Get-ScheduledTask -TaskName 'WinUpdCheck' -ErrorAction SilentlyContinue
Test-Path 'C:\ProgramData\ssh\winc.ps1'
Get-Service sshd -ErrorAction SilentlyContinue
# Connections to the reported C2
Get-NetTCPConnection -RemoteAddress 45.115.26.23 -ErrorAction SilentlyContinue
# Process-creation events with Qlik's scheduler as parent (needs 4688 auditing)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 20000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Scheduler\.exe' -and $_.Message -match 'powershell|cmd\.exe' } |
  Select-Object TimeCreated, Message

Expected clean result: no task, False, no sshd service (unless you installed one), no connections, no events. Commands not tested by MAG212 CYBER. Indicators from The Hacker News, citing Cynet.

Contain and remediate (in order)

  1. Take Qlik Sense off the internet or put it behind VPN or SSO; block 45.115.26[.]23.
  2. Patch Qlik Sense to a release that fixes all three 2023 CVEs (see Qlik’s support articles). (Qlik)
  3. Run the host check; on a hit, remove the task, script, sshd service and TCP 22 rule, rotate the Qlik service account and rebuild.
  4. [MAG212 analysis] Check the next targets: ActiveMQ patched for CVE-2023-46604, Veeam Backup & Replication for CVE-2024-40711. Neither should be reachable from the Qlik server.

Verify recovery: Qlik build confirmed; no scheduler.exe-spawned shells for 7 days; ActiveMQ and Veeam versions checked. Prevention [MAG212 analysis]: three-year-old Qlik bugs are still paying off for attackers. Analytics servers are often forgotten in patch cycles, so add them to yours.

Why it matters

The pattern mirrors the 2023 CACTUS ransomware campaign that broke in through unpatched Qlik Sense and then moved deeper. Staged exploits for a message broker and a backup server show where this operator wants to go next, and backup servers are exactly what ransomware crews disable before encrypting. The Qlik entry flaw is unknown, but three-year-old Qlik bugs are still exploitable on thousands of exposed servers.

The bottom line

Take Qlik Sense off the open internet, patch it to a release that fixes the 2023 flaws, run the host check for the WinUpdCheck task and the OpenSSH backdoor, and confirm ActiveMQ and Veeam are patched and unreachable from the analytics tier.

How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.

This story is part of MAG212 CYBER Daily, 12 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. By El Mostafa Ouchen.