Summary
- Cynet observed suspicious activity across several European Qlik Sense environments within approximately three minutes.
- The associated infrastructure hosted Windows and Linux backdoors, persistence tools, and material targeting ActiveMQ and Veeam.
- The initial vulnerability remains unconfirmed, and successful exploitation of the additional products has not been established.
Several European organisations experienced closely timed malicious activity affecting Qlik Sense business intelligence servers, with researchers identifying attempts to establish remote access and infrastructure containing additional tools for attacking enterprise applications.
Cybersecurity company Cynet identified the activity during October 2026 after its security operations and research teams observed the same suspicious process sequence across multiple EU customer environments.
The attempts occurred within a period of just over three minutes, suggesting coordinated activity directed at several installations.
Investigators observed the Qlik Sense scheduler process launching commands associated with a PowerShell reverse shell, a mechanism intended to create an external connection through which an attacker could issue further instructions.
Cynet blocked the initial script within its monitored environment, preventing the reverse shell from running successfully there.
Analysis of the associated infrastructure revealed Windows and Linux remote-access tools, persistence mechanisms, and material referencing vulnerabilities in other enterprise software.
Attack pattern resembles earlier Qlik intrusions
Researchers identified similarities to attacks against Qlik Sense documented in 2023, when Cactus ransomware operators exploited previously disclosed vulnerabilities in the business intelligence platform.
Those earlier attacks involved CVE-2023-41266 and CVE-2023-41265, which could be combined to bypass access restrictions and execute commands. Another weakness, CVE-2023-48365, subsequently enabled unauthorised code execution through related functionality.
Cynet identified the older flaws as possible explanations for the latest process behaviour but has not established which vulnerability was used in October.
The findings do not support describing the current activity as a new zero-day exploit, nor do they establish that the same ransomware operators were responsible.
They show that attacker behaviour resembling earlier campaigns continues to appear around business intelligence software connected to sensitive organisational information.
Staging infrastructure held additional tools
The investigation traced the suspicious commands to a server hosting a publicly accessible collection of scripts and executable files.
Researchers found a custom Windows backdoor written in Go, versions intended for several Linux architectures, and scripts designed to retain remote access after the initial entry point was no longer needed.
Some components attempted to establish SSH access or scheduled execution mechanisms, which could permit continued control if successfully deployed.
The collection also contained material associated with Apache ActiveMQ and a modified version of public exploit code related to CVE-2024-40711 in Veeam Backup & Replication.
However, Cynet found that portions of the Veeam material appeared incomplete or configured for local testing. Researchers did not observe successful exploitation of Veeam or ActiveMQ through the recovered files.
Possession of exploit material on a staging server does not prove it was used successfully against every product referenced within that collection.
Controlled testing showed attempted persistence
Cynet executed selected recovered components within a controlled laboratory environment to observe their behaviour.
The resulting connections received commands consistent with system reconnaissance, including inspection of operating system and network configuration and the discovery of installed applications.
Additional commands attempted to establish persistent access and, in some Linux testing, examine credential files.
These laboratory observations describe the capabilities of the recovered tooling rather than confirmed outcomes in the affected production environments.
That distinction is important because Cynet’s monitored defensive controls prevented the initial reverse shell from executing.
Analytics systems can hold sensitive connections
Qlik Sense commonly retrieves business information from databases and applications. Depending on its deployment, a server may hold service credentials or connections allowing access to additional systems.
A successful intrusion could therefore expose more than the analytics service itself, particularly where connected identities have broad permissions.
Organisations maintaining Qlik Sense should review applicable patches, the exposure of administrative and application services, and unexpected process activity initiated by the platform.
Where indicators of compromise are found, investigation may need to extend to connected credentials and persistence mechanisms rather than stopping at the initial server.
Cynet’s ZeroQlik technical investigation documents the observed activity and recovered tools.
The initial exploit, the full extent of compromise, and the identity of the operator remain unresolved, but the closely timed activity establishes a coordinated attempt against European business intelligence infrastructure.
