Attempted to reverse shell in Qlik Sense points to 45.115.26.23, detected in October 2026

In October 2026, Cynet researchers detected engagement attempts against Qlik Sense servers trying to execute a one-liner PowerShell to open a reverse shell to address 45.115.26 [.] 23 (ports 4455 and 4456). According to the company's report, the actions occurred in a very short period - just over three minutes - and have technical similarities with a campaign documented in November 2023 that abused vulnerabilities in Qlik Sense to get initial access and deploy remote control and persistence tools.

Facts confirmed: Cynet observed executions of PowerShell commands initiated by scheduler.exe, outbound connection attempts at 45.115.26 [.] 23: 4455 that were blocked in the attacked environments, and, in controlled tests, the opening of an interactive channel that allowed the deployment of an additional backdoor (a Go binary) that connects to 45.115.26 [.] 23: 4456. Also in the operational infrastructure (in 45.115.26 [.] 23: 8012) was found an accessible directory with files including a go-door for Windows, SSH persistence scripts, an explosion directed at Apache ActiveMQ (CVE-2023-46604) and a modified version of Veeam-related public tools for CVE-2024-40711.

Context of known vulnerabilities: Qlik Sense had several high-gravity vulnerabilities in 2023 that were parched in August and September of that year. These include CVE-2023-41265 (HTTP tunneling with privilege climbing potential) and CVE-2023-48365 (remote execution by inadequate HTTP header validation, known as "DoubleQlik"). The EQs are available on public bases: CVE-2023-41265 and CVE-2023-48365. In 2023, actors linked to the CACTUS operation took advantage of these weaknesses to establish footholds and deploy tools such as AnyDesk, Plink and UEMS.

What is known and what is still uncertain: It is confirmed that there were attempts to reverse shell and that the attacker's infrastructure hosted various tools and exploits. It is not confirmed which (if any) of the 2023 EQs or any new failure was the entry door in the October 2026 incidents; Cynet indicates thatthe exact explosion used to compromise the Qlik Sense servers in this case is not yet identified. There is also no public evidence at this time that attempts have resulted in the deployment of ransomware in this particular wave.

Technically, the observed pattern has several clear phases. First, running PowerShell from scheduler.exe with a chain intended to start a remote shell. Second, the establishment of an interactive channel that in laboratory allowed to transfer and run a Go (backdoor) binary that makes recognition (search for processes related to Apache ActiveMQ) and, in Linux systems, attempts to read / etc / shadow and / etc / passd. Third, variants that install OpenSSH on Windows to get persistence: creating a scheduled task called "WinUpCheck" that runs C:\ ProgramData\ ssh\ winp.ps1 every five minutes; if sshd is not present, download and run a legitimate OpenSSH-Win64.zip package from the staging server and configure the sshd service to boot automatically, in addition to opening a firewall rule for TCP / 22.

Who does this affect? Mainly organizations that maintain instances of Qlik Sense Enterprise for Windows that are not properly patched or that expose administrative interfaces without appropriate network restrictions. However, the operator shows interest in additional components (ActiveMQ, backup tools like Veeam), so the attack chain can be extended to other applications with exposed surfaces within the same network.

Practical implications: even if the initial execution of the reverse shell was blocked in the observed environments, the tactic reveals attempts to establish persistent channels and mechanisms for lateral movement (OpenSSH installation, ActiveMQ process search, potential hash theft and passwords in Linux systems). If any of these steps were successful, the attacker could maintain long-term access, install additional back doors and prepare more harmful deployments such as mass exfiltration or data encryption.

Specific and prioritized recommendations for security managers and teams:

1) Check patches and configurations of Qlik Sense: confirm that its instances applied the corrections published in 2023 for CVE-2023-41265 and CVE-2023-48365, and apply any additional patch available from Qlik. If you cannot park immediately, limit access to the console and endpoints of the repository only to reliable management networks and via VPN or white IP lists.

2) Search for specific indicators in endpoints: track executions of Scheduler.exe that launch PowerShell with unusual parameters (-NoProfile, -EncodedCommand, commands that open sockets), presence of C:\ ProgramData\ ssh\ win.ps1, programmed tasks called "WinUpCheck," recent OpenSSH installation or creation of firewall rules for TCP / 22, and outgoing connections to 45.115.26 [.] 23: 4455 / 4456 / 8012. Check proxy / firewall logs for those IP / ports and capture any binary downloaded from that direction.

3) Response to suspicion of commitment: isolate the affected machines, preserve images and logs for forensic analysis, rotate credentials with priority (especially Qlik service and administrative accounts), and perform comprehensive scans with EDR / AV. If persistence is detected (scheduled tasks, recently installed sshd services, binary Go unknown), proceed to the eradication and reconstruction of the system from reliable images.

4) Network management and mitigation: block at perimeter level traffic to 45.115.26 [.] 23 and known command and control routes; apply network segmentation to separate analytical and management platforms; implement white lists of applications where possible and reduce service privileges that can invoke scheduler.exe or run remote commands.

(5) Detection and proactive hunting: look for processes that do / etc / shadow or / etc / passd readings on Linux servers, monitor the use of Plink / AnyDesk / AnyDesk-like and ManageEngine UEMS (tools that were deployed in the CACTUS campaign of 2023), and correct any unnecessary public exposure of Apache ActiveMQ or backup interfaces.

To expand on the related Qlik vulnerabilities, see the public CVE entries: CVE-2023-41265 and CVE-2023-48365 (DoubleQlik). These references help to map techniques observed with known failures and to prioritize patches.

Conclusion: The October 2026 wave represents a reminder that old vulnerabilities, even shackles, can continue to be exploited when the corrections were not applied or when the exposure vectors were not reduced. The most effective defenses combine appropriate patches, segmentation and network visibility, behavior-focused detections (e.g. scheduler.exe initiating shells) and rapid response actions to cut down persistencies before they allow lateral movement or exfiltration.