Executive Summary
In October 2026, threat actors associated with the CACTUS ransomware operation were observed targeting Qlik Sense Enterprise servers to deliver PowerShell-based reverse shells. This activity shows significant overlap with a November 2023 campaign where the group weaponized HTTP tunneling and path traversal vulnerabilities (DoubleQlik) to gain initial footholds. The current campaign involves rapid, automated attempts to establish persistence across multiple environments within minutes.
Technical analysis reveals a sophisticated multi-stage infection chain utilizing PowerShell one-liners, Go-based backdoors, and the installation of OpenSSH for persistent access. The actors are also staging exploit toolchains for other critical vulnerabilities, including CVE-2023-46604 (Apache ActiveMQ) and CVE-2024-40711 (Veeam Backup & Replication). This suggests a broader strategic objective to move laterally and compromise backup infrastructure, which is a hallmark of CACTUS ransomware deployments.
Organizations using Qlik Sense, Apache ActiveMQ, or Veeam should prioritize patching these specific vulnerabilities immediately. The discovery of staging directories containing exploit tools for these platforms indicates that the threat actors are actively expanding their target surface to maximize the impact of their ransomware operations.