Cactus ransomware leverages Qlik Sense vulnerabilities for network breaches

In the dynamic landscape of cybersecurity, the Cactus ransomware has adeptly navigated through significant vulnerabilities within the Qlik Sense data analytics solution, making waves by infiltrating corporate networks. Let's delve into the intricacies of this cybersecurity dance and the proactive measures to shield your digital domain.

Unlocking Insights with Qlik Sense:

Qlik Sense stands as a beacon in the realm of data analytics, empowering users to craft personalized reports and dynamic visualizations from diverse data sources. Positioned at the nexus of innovation, this versatile tool not only informs decision-making processes but also offers the flexibility to operate seamlessly, be it locally or in the expansive realms of cloud environments.

The Vulnerability Saga:

Late August witnessed a pivotal moment as the vendor responded to the challenge, addressing two critical vulnerabilities in the Windows version of Qlik Sense. CVE-2023-41266, a path traversal bug, opened the gateway for anonymous sessions and unauthorized HTTP requests. Simultaneously, CVE-2023-41265, boasting a severity rating of 9.8, granted unhindered privilege elevation and backend server HTTP requests sans authentication.

Qlik's Ongoing Battle:

September 20 marked a new chapter in the battle against vulnerabilities as Qlik discovered the initial fix for CVE-2023-41265 falling short, necessitating a swift response in the form of a new update—CVE-2023-48365. The urgency escalated as Arctic Wolf, a cybersecurity bastion, raised the alarm on active exploitation by Cactus ransomware, particularly on unpatched Qlik Sense instances.

Unraveling Cactus Ransomware Tactics:

Cactus ransomware orchestrates its operations by manipulating the Qlik Sense Scheduler service, employing PowerShell and BITS to initiate processes. The arsenal includes tools like ManageEngine UEMS, AnyDesk, and a cunningly renamed Plink binary, strategically deployed for persistence and remote access. Discovery commands unfold, with output redirected into .TTF files, potentially serving as a covert channel for command output via path traversal.

The Elusive Threat Actor:

To remain undetected, the threat actor executes various stealth maneuvers, from uninstalling Sophos antivirus to altering administrator passwords and establishing RDP tunnels using Plink. The grand finale sees the deployment of Cactus ransomware, leaving a digital wake of compromised systems.

Mitigation Strategies:

In the face of this evolving threat, Qlik advises a proactive stance by upgrading to specific Sense Enterprise for Windows versions. These updates—August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, November 2021 Patch 17—serve as a digital shield against the encroaching menace.

The Cactus ransomware saga underscores the need for vigilance in the ever-shifting landscape of cybersecurity. By understanding the nuances of this threat and embracing proactive measures, organizations can fortify their digital ramparts, ensuring resilience against the intricate dance of evolving cyber adversaries.