CACTUS

Threat Actors Target Qlik Sense Servers with Reverse Shells and Stage ActiveMQ and Veeam Exploits

Cybersecurity researchers at Cynet have detected threat actors attempting to compromise Qlik Sense servers by deploying PowerShell reverse shells in multiple environments during October 2026. The activity shows overlap with a 2023 campaign attributed to the CACTUS ransomware operation that exploited newly disclosed vulnerabilities in Qlik Sense Enterprise for Windows. Although the exact entry vector remains unknown, the commands were executed under scheduler.exe and attempted to establish persistence through additional payloads including a Windows Go reverse shell. The infrastructure also hosted exploits for Apache ActiveMQ CVE-2023-46604 and a modified Veeam toolchain targeting CVE-2024-40711, suggesting preparation for wider attacks. Earlier intrusions linked to CACTUS involved deployment of ManageEngine UEMS, AnyDesk, and Plink after initial access via the Qlik flaws. Cynet blocked the reverse shell attempts but confirmed the backdoor's use for reconnaissance and persistence mechanisms such as scheduled tasks and OpenSSH installation.