Qlik Sense Exploited in Cactus Ransomware Campaign

Arctic Wolf Labs observed a campaign exploiting public Qlik Sense vulnerabilities to achieve remote code execution and deploy Cactus ransomware; actors used the Qlik Sense Scheduler to launch PowerShell/BITS downloads of renamed ManageEngine UEMS, AnyDesk, and Plink, carried out discovery and persistence actions (including uninstalling Sophos and changing the administrator password), established RDP tunnels, and exfiltrated data with rclone — the report includes IPs, domains, file paths, and file hashes as IoCs.