---
title: Hunt: Qlik Sense servers hit in a three-minute burst, scheduler.exe spawning PowerShell reverse shells, with ActiveMQ and Veeam exploits staged | ctxsec
url: https://ctxsec.com/items/hunt-cynet-qlik-sense-scheduler-exe-reverse-shell-go-agent-activemq-veeam-staging
description: "Cynet saw the same process pattern on Qlik Sense servers at several EU customers within about three minutes in October 2026: scheduler.exe launching an encoded PowerShell reverse shell, the same tree seen in the 2023 Cactus ransomware Qlik intrusions. Cynet thinks the actor used the old Qlik Sense bugs CVE-2023-41266/41265 or CVE-2023-48365. Cynet blocked the shell. An open directory on the attacker's server held a Go backdoor, persistence scripts, ActiveMQ CVE-2023-46604 payloads and a modified watchTowr Veeam CVE-2024-40711 toolchain that looked still in testing."
status: "vendor research (Cynet, Nov 11, 2026); the exact Qlik vulnerability is Cynet's assessment, and Cynet saw no successful ActiveMQ or Veeam exploitation"
published: 2026-11-11
---

> Cynet saw the same process pattern on Qlik Sense servers at several EU customers within about three minutes in October 2026: scheduler.exe launching an encoded PowerShell reverse shell, the same tree seen in the 2023 Cactus ransomware Qlik intrusions. Cynet thinks the actor used the old Qlik Sense bugs CVE-2023-41266/41265 or CVE-2023-48365. Cynet blocked the shell. An open directory on the attacker's server held a Go backdoor, persistence scripts, ActiveMQ CVE-2023-46604 payloads and a modified watchTowr Veeam CVE-2024-40711 toolchain that looked still in testing.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-cynet-qlik-sense-scheduler-exe-reverse-shell-go-agent-activemq-veeam-staging.md)

vendor research (Cynet, Nov 11, 2026); the exact Qlik vulnerability is Cynet's assessment, and Cynet saw no successful ActiveMQ or Veeam exploitation

2026-11-11 11:37 AM ET

### Hunt: Qlik Sense servers hit in a three-minute burst, scheduler.exe spawning PowerShell reverse shells, with ActiveMQ and Veeam exploits staged

- **Process tree:** `scheduler.exe` > `cmd.exe /c powershell -nop -w hidden -enc` on Qlik Sense hosts.
- **Network:** 45.115.26[.]23: HTTP check-in `/hb?` on 80, reverse shell on 4455, Go agent on 4456, Bash agent on 4457, staging on 8012.
- **Persistence:** Ed25519 key `node6-sm` added to `C:\ProgramData\ssh\administrators_authorized_keys`, OpenSSH installed with a TCP 22 firewall rule, `C:\ProgramData\ssh\winc.ps1` run by scheduled task `WinUpdCheck` every 5 minutes, `C:\Windows\Temp\wsvc.exe` as service `wsvc` ('Windows Service Controller').
- **Discovery tells:** commands chained with `echo F1`, `F2` ... `DONE2` markers, checks for SmarterMail folders and ActiveMQ ports 61616 and 8161.
- **Do:** patch Qlik Sense (the 2023 fixes), keep it off the internet, and check ActiveMQ and Veeam servers are patched against CVE-2023-46604 and CVE-2024-40711. Hashes are in the report.

Sources: [Cynet Research: ZeroQlik Returns, Exploiting N-Days Still Pays Off (Nov 11, 2026)](https://www.cynet.com/security-foundations/attack-techniques/exploiting-qlik-sense-servers/)