Hackers have been observed exploiting multiple critical vulnerabilities in the Qlik Sense data analytics solution to deploy ransomware and steal sensitive corporate data.
A new report from cybersecurity researchers Arctic Wolf claims that Cactus exploited three flaws discovered and fixed in late August and late September 2023.
According to the report, Qlik first discovered two flaws in late August this year: CVE-2023-41265 and CVE-2023-41266. A month later, the company discovered that one of the patches did not work as intended, leading to a separate vulnerability, tracked as CVE-2023-48365. All three flaws were subsequently addressed and patches were issued.
Mitigating the threat
These three flaws allowed attackers to generate anonymous sessions and execute HTTP requests to unauthorized endpoints, or escalate privileges and execute HTTP requests on backend servers hosting the application.
Cactus used the flaws as a means of initial access to corporate networks with unpatched Qlik Sense instances. The group forced the Qlik Sense Scheduler service to initiate new processes and then used PowerShell and the Background Intelligent Transfer Service (BITS) to download remote access software such as AnyDesk.
It also used various information-stealing software to obtain sensitive corporate data, but ultimately it was the Cactus encryptor that was the most disruptive. To protect against such attacks, Qlik recommended that its users upgrade to the following versions of Sense Enterprise for Windows:
- August 2023 Patch 2
- May 2023 Patch 6
- February 2023 Patch 10
- November 2022 Patch 12
- August 2022 Patch 14
- May 2022 Patch 16
- February 2022 Patch 15
- November 2021 Patch 17
Cactus is a relative newcomer to the ransomware game and was first noticed in March of this year. It has the usual modus operandi of stealing sensitive data and encrypting systems, then later demanding payment in cryptocurrency in exchange for the decryption key and keeping the data private.
Through BleepingComputer