CRITICAL: Vulnerable/Compromised Qlik Sense Special Report
DESCRIPTION LAST UPDATED: 2024-04-28 DEFAULT SEVERITY LEVEL: CRITICAL This one-time Special Report contains information about currently known vulnerable and/or compromised Qlik Sense appliances.  This is shared by Fox-IT in collaboration with DIVD (thank you!). You can read more details behind the current incidents involving Cactus ransomware and affected device identification methodology in “Sifting through the […]
/wp-content/themes/shadowserver/build/images/favicons/apple-touch-icon-57x57.png
DESCRIPTION LAST UPDATED: 2024-04-28

DEFAULT SEVERITY LEVEL: CRITICAL

This one-time Special Report contains information about currently known vulnerable and/or compromised Qlik Sense appliances. This is shared by Fox-IT in collaboration with DIVD (thank you!). You can read more details behind the current incidents involving Cactus ransomware and affected device identification methodology in “Sifting through the spines: identifying (potential) Cactus ransomware victims” blog by Fox-IT. Cactus ransomware being used against Qlik instances was first documented by ArticWolf on Nov 28th, 2023 in a blog post titled “Qlik Sense Exploited in Cactus Ransomware Campaign“.

Vulnerabilities exploited by Cactus ransomware may include:

– CVE-2023-41265

– CVE-2023-41266

– CVE-2023-48365

If you receive an alert from us on a vulnerable instance detected in your network or constituency please also assume compromise of your instance and possibly your network.

Compromised instances are determined remotely by checking for the presence of files with .ttf or .woff file extension.

Please note Shadowserver has now added also CVE-2023-48365 scans based on the above collaboration- in our CRITICAL: Vulnerable HTTP Report. You can track vulnerable instances on our Dashboard.

We will also start regularly reporting compromised instances in our CRITICAL: Compromised Website Report starting 2024-04-26. You can track compromised instances on our Dashboard.

This special report has severity level CRITICAL set on all events. Severity levels are described here.

About Special Reports

Shadowserver Special Reports are unlike all of our other standard free daily network reports.

Instead, we send out Special Reports in situations where we share one-time, high value datasets that we feel should be reported responsibly for maximum public benefit, such as in cases where we have a critical new vulnerability being exploited against potentially high value targets.

Note that the data shared across special reports may differ on a case by case basis hence the report formats for different Special Reports may be different.