Attackers have been probing Qlik Sense analytics servers in Europe, attempting to plant PowerShell reverse shells that would hand them remote control, security researchers report. The attempts were blocked, but an exposed staging server used by the same intruders shows they are also preparing exploits for Apache ActiveMQ and Veeam backup software.

Three minutes of coordinated probes

Cynet's CyOps and research teams detected the activity in October 2026 against several customers in the European Union, all within a window of just over three minutes. In each case, a one-line PowerShell reverse shell ran under scheduler.exe, the Qlik Sense Scheduler process, and tried to connect to the address 45.115.26.23 on port 4455.

Cynet said it does not yet know which vulnerability the attackers used. The process pattern resembles a November 2023 campaign documented by Arctic Wolf, in which intruders linked to the CACTUS ransomware operation exploited newly disclosed Qlik Sense flaws. Cynet stressed the resemblance is only an overlap, and it has not attributed the new activity to CACTUS or any other group.

ActiveMQ and Veeam exploits staged

Investigators found an open directory on the same address, port 8012, holding a custom Windows Go backdoor, SSH persistence scripts, exploit material for Apache ActiveMQ (CVE-2023-46604) and a modified public toolchain for a Veeam flaw (CVE-2024-40711). A Linux variant tried to read /etc/shadow and /etc/passwd, while another script tried to install OpenSSH and create a scheduled task called WinUpdCheck to relaunch a reverse shell every five minutes.

Cynet said the ActiveMQ and Veeam tools did not look production-ready, suggesting the attackers are still testing them. Even so, it urged organisations to patch Qlik Sense, ActiveMQ and Veeam, watch for suspicious PowerShell activity and restrict inbound SSH access. The Hacker News first reported the campaign, and Cynet published the full technical analysis.