Qlik Sense, new target for reverse shells and exploits

Qlik Sense in the crosshairs: reverse shells and exploitation of ActiveMQ and Veeam

The CyOps and Research team at Cynet has detected a campaign targeting Qlik Sense servers in which attackers attempted to execute PowerShell commands to obtain reverse shells. The events occurred in October 2026 and affected several customers based in the European Union within a window of just over three minutes. Although the attempts were unsuccessful, the activity shares similarities with exploitation tactics for ActiveMQ and Veeam, suggesting growing interest on the part of attackers in these platforms.

What is a reverse shell and why Qlik Sense?

A reverse shell is a technique that allows an attacker to take remote control of a server. The malware establishes a connection from the victim to the attacker, thereby bypassing firewall restrictions that block incoming connections. Qlik Sense, a data analytics platform widely used in the business environment, becomes an attractive target because it usually stores sensitive information and, on many occasions, is deployed with default configurations or without the latest updates.

In this case, the attackers attempted to execute PowerShell commands to launch the reverse shell. Although the attempt did not succeed, the fact that they targeted several customers within such a short interval indicates automated scanning and an active search for vulnerabilities in this type of server.

Relationship with ActiveMQ and Veeam

The news reports that the activity shares similarities with the exploitation of ActiveMQ and Veeam. These products are also common in business infrastructures and have been the subject of critical vulnerabilities in the past. Attackers often reuse techniques and tools that have worked for them on other platforms, adapting them to new targets. Therefore, it would not be unusual if we were dealing with the same group or a coordinated campaign seeking to take advantage of known flaws in data management, messaging, and backup software.

Impact for SMEs and IT teams

For an SME, a compromised Qlik Sense server can mean the exposure of financial, commercial, or customer data. In addition, if the attacker achieves a reverse shell, they could move laterally to other systems, such as ActiveMQ or Veeam, and compromise backups or internal messaging. The three-minute window in which the attempts occurred reflects the speed of automated attacks: any delay in applying patches or in detection can be critical.

IT teams should review whether their Qlik Sense servers are exposed to the internet. In many cases, these platforms are deployed on internal networks, but in hybrid environments or with remote access, the attack surface increases. It is also essential to check PowerShell logs and unusual outbound connections, since a reverse shell manifests as a connection from the server to an unrecognized external IP.

ForgeNEX recommendations

• Update Qlik Sense and its associated components to the latest available version. Patches usually fix vulnerabilities that attackers exploit.
• Restrict access to Qlik Sense servers through network segmentation and access control lists. Do not expose these services directly to the internet if it is not essential.
• Enable detailed PowerShell logs and monitor suspicious outbound connections. Tools such as Sysmon or EDR solutions can help detect reverse shells.
• Review the configuration of ActiveMQ and Veeam if your organization uses them, and apply the most recent security updates. The news suggests that attackers could be preparing exploits for these platforms.
• Establish an incident response plan that includes rapid containment of a compromised server and review of backups.

Early detection is key. In an attack that lasts only a few minutes, the difference between a failed attempt and a successful compromise can depend on a well-configured firewall rule or an anomalous behavior alert. For SMEs with limited resources, having a technology partner that monitors these systems and applies patches proactively can make the difference.

This incident adds to a worrying trend: attackers are not only looking for vulnerabilities in office or email software, but also in analytics and backup platforms. As we discussed in the article on the Westcon-Comstor record driven by cybersecurity, investment in security is no longer an optional expense for SMEs, but a necessity to protect their data and their business continuity.

At ForgeNEX we recommend periodically reviewing the exposure surface of all critical services, not only the most obvious ones. The campaign against Qlik Sense shows that attackers are actively exploring data analytics platforms. If your company uses Qlik Sense, ActiveMQ, or Veeam, it is time to verify that the configurations are secure and that the patches are up to date.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.