[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

vendor research (Cynet, Nov 11, 2026); the exact Qlik vulnerability is Cynet's assessment, and Cynet saw no successful ActiveMQ or Veeam exploitation

Hunt: Qlik Sense servers hit in a three-minute burst, scheduler.exe spawning PowerShell reverse shells, with ActiveMQ and Veeam exploits staged

  • Process tree: scheduler.exe > cmd.exe /c powershell -nop -w hidden -enc on Qlik Sense hosts.
  • Network: 45.115.26[.]23: HTTP check-in /hb? on 80, reverse shell on 4455, Go agent on 4456, Bash agent on 4457, staging on 8012.
  • Persistence: Ed25519 key node6-sm added to C:\ProgramData\ssh\administrators_authorized_keys, OpenSSH installed with a TCP 22 firewall rule, C:\ProgramData\ssh\winc.ps1 run by scheduled task WinUpdCheck every 5 minutes, C:\Windows\Temp\wsvc.exe as service wsvc ('Windows Service Controller').
  • Discovery tells: commands chained with echo F1, F2 ... DONE2 markers, checks for SmarterMail folders and ActiveMQ ports 61616 and 8161.
  • Do: patch Qlik Sense (the 2023 fixes), keep it off the internet, and check ActiveMQ and Veeam servers are patched against CVE-2023-46604 and CVE-2024-40711. Hashes are in the report.

Sources: Cynet Research: ZeroQlik Returns, Exploiting N-Days Still Pays Off (Nov 11, 2026)