Attackers go after Qlik Sense servers and stage exploits for ActiveMQ and Veeam

Three-year-old flaws in Qlik Sense, a data analytics platform many companies run on their own Windows servers, are being targeted again. Security company Cynet reported on November 11, 2026 that in October it saw the same suspicious commands on Qlik Sense servers at several customers in the EU, all within about three minutes. Its products blocked the attempts, but the attacker’s own server showed what they were preparing next: tools to break into ActiveMQ message brokers and Veeam backup servers. The Hacker News covered the findings the same day. Here’s what was found and what to check.

What happened

On each server, Qlik Sense’s Scheduler.exe started cmd.exe, which launched a hidden, encoded PowerShell command. That chain matches what Arctic Wolf saw in November 2023, when the Cactus ransomware group exploited Qlik Sense flaws to get into networks. Cynet says the attacker likely used the same bugs: CVE-2023-41266 and CVE-2023-41265, or CVE-2023-48365 (“DoubleQlik”), which got around Qlik’s first fix. All three were patched in 2023. Cynet hasn’t confirmed which one was used.

The PowerShell command reported the computer’s name and user to the attacker, then tried to open a reverse shell, a connection that hands the attacker a command line on the server. Cynet blocked it before the shell started. It hasn’t linked this activity to Cactus or any named group, only to the same technique.

What the attacker’s server revealed

The address the reverse shell called also hosted an open folder. In it Cynet found:

• A custom backdoor written in Go, built for Windows and several Linux and embedded-device platforms, that takes commands from the attacker’s server.
• Persistence scripts that add the attacker’s SSH key to Windows, install and start OpenSSH, open port 22 in the firewall, and create a scheduled task named WinUpdCheck that relaunches the reverse shell every five minutes.
• Exploit material for Apache ActiveMQ (CVE-2023-46604) and a modified public exploit kit for Veeam Backup & Replication (CVE-2024-40711).

Cynet says the ActiveMQ and Veeam tools didn’t look ready for use yet and seemed to be in testing. It didn’t see any customer successfully exploited through either. When Cynet ran the reverse shell in a lab, the attacker’s server sent commands that checked for ActiveMQ and for SmarterMail mail data, and on Linux tried to read /etc/shadow and /etc/passwd.

Why it matters

Veeam backup servers are a favourite ransomware target, because wiping or encrypting backups makes a company more likely to pay. An attacker collecting old, well-known exploits for analytics, messaging and backup software is betting that some organisations still haven’t patched them.

What you can do

If your organisation runs Qlik Sense Enterprise for Windows, ActiveMQ or Veeam:

1. Patch. Qlik Sense fixes for these flaws have been out since 2023, ActiveMQ’s since 2023 and Veeam’s since 2024. If you can’t patch Qlik Sense right away, don’t expose it to the internet.
2. Check Qlik Sense servers for Scheduler.exe starting cmd.exe or PowerShell, a scheduled task named WinUpdCheck, a C:\ProgramData\ssh\winc.ps1 file, unexpected keys in administrators_authorized_keys, a service named wsvc (“Windows Service Controller”), and an OpenSSH server you didn’t install.
3. Look for connections to 45.115.26.23 on ports 80, 4455, 4456 and 8012, the address Cynet published.
4. Keep backups out of reach: separate admin accounts for Veeam, offline or immutable copies, and no backup server reachable from the internet.

How Frame helps

This is about attacks on company servers, not a list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t monitor servers.

Related coverage

• Microsoft: attackers keep a back door into hacked Linux web servers with GSocket: another report this week on how attackers keep access after the first break-in.
• A researcher published 33 N-central flaws with working exploits, and N-able took the service offline: why widely deployed management software draws attackers.

Sources

• Cynet, ZeroQlik Returns: Exploiting N-Days Still Pays Off, November 11, 2026
• The Hacker News, Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits, November 11, 2026