Security researchers have identified a new campaign involving the Cactus ransomware group exploiting a critical vulnerability in Qlik Sense, a widely used business intelligence platform. The attackers use the flaw to gain unauthenticated remote code execution (RCE), enabling lateral movement and subsequent deployment of ransomware payloads. This exploitation demonstrates heightened adversary interest in misconfigured or unpatched business analytics platforms as an initial point of compromise. The impact is significant for enterprises relying on Qlik Sense for sensitive data visualization and centralized reporting.Table of ContentsIntroductionTechnical BackgroundAttack / TechniqueDetectionMitigationConclusionIntroductionIn January 2026, Cactus ransomware actors were observed targeting unpatched instances of Qlik Sense Enterprise through a known remote code execution vulnerability. The affected platform, commonly used by organizations to visualize and analyze business data, presents a high-value entry point into enterprise environments due to its integration with backend databases and authentication services. This campaign fits into a broader trend of ransomware affiliates pivoting towards exploiting mismanaged enterprise software with reliable external exposure for initial access vectors.Technical BackgroundQlik Sense is a self-service data analytics solution, often deployed on-premises behind corporate firewalls but sometimes exposed to the internet to support remote access. The vulnerability—tracked as CVE-2023-41265—allows unauthenticated attackers to execute arbitrary code via improper handling of crafted requests due to a flaw in the application's request parsing logic. Successful exploitation permits threat actors to achieve system-level access on the Qlik Sense server, from which further network compromise can occur.Attack / TechniqueThe Cactus operators began their campaigns by scanning for publicly accessible Qlik Sense instances. Upon identifying vulnerable systems, they executed the exploit payload remotely, achieving command-line access without prior authentication. Post-compromise actions included domain enumeration, user credential harvesting, and deployment of additional tools such as credential dumpers and tunneling utilities. Investigators noted the use of scheduled tasks and living-off-the-land binaries (LOLBins) for persistence and evasion, followed by the final ransomware payload execution to encrypt organizational assets.DetectionDetection of this activity should focus on correlating unusual Qlik Sense process behavior with network anomalies. Indicators include:Unexpected command execution by Qlik-associated services (e.g., qliksense.exe invoking cmd.exe or powershell.exe)Outbound connections from Qlik systems to uncommon external IPsDownloads of executable payloads from remote sources via HTTP/HTTPSCreation of scheduled tasks with suspicious names or binary pathsEvent log artifacts indicating privilege escalation or new service installationNetwork traffic analysis and endpoint behavior monitoring are essential to catch these early-stage exploit attempts.MitigationTo mitigate the risk posed by this attack vector, organizations should:Immediately apply the security patch for CVE-2023-41265 to all Qlik Sense installationsAvoid exposing Qlik Sense management interfaces to the internet unnecessarilyEnforce multi-factor authentication (MFA) for administrative accountsImplement network segmentation to isolate business intelligence servers from critical system resourcesConduct regular vulnerability assessments and patch validation audits involving business analytics systemsConclusionThe exploitation of Qlik Sense by Cactus ransomware actors underscores the critical need for timely patch management and secure configuration practices, especially for externally accessible enterprise platforms. As attackers continue to diversify their initial access methods, SOC teams must ensure continuous monitoring of unconventional infrastructure targets such as business intelligence systems. The integration of threat intelligence and proactive vulnerability scanning can significantly decrease dwell time and attacker success rates.Related ReadingCactus ransomware hackers breach Qlik Sense servers in new attacks
