topic Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this? in Management & Governance

"Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

diagonjope — Thu, 30 Nov 2023 16:02:38 GMT

Greetings!

I just saw this article about a supposed ransomware security risk in QliK Sense and would like to receive instructions on what to do (if true):

https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/

Customers are asking us about it, but I can't find anything related to this issue in the community. Please advise and referer to @diagonjope in your note, so that I can get a notification.

Cheers,

++José

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

daveatkins — Thu, 30 Nov 2023 17:42:51 GMT

we patched our servers earlier this year; can someone from Qlik please link/list the appropriate patch levels here again?

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

Albert_Candelario — Thu, 30 Nov 2023 21:21:54 GMT

Hello all, @diagonjope @daveatkins

Thanks for posting here.

As it is also explained on https://www.arcticwolf.com/resources/blog/cve-2023-41265-cve-2023-41266-cve-2023-48365/ these vulnerabilities were already mentioned some time ago, we strongly recommend to stay on the mentioned patches or newest ones, as newest ones will have those fixes plus more fixes included as patches are cumulative as per the release notes.

Furthermore, I strongly recommend you to subscribe to our Support Blog so next time you do not miss such communications and other relevant ones about Qlik products.

https://community.qlik.com/t5/Support-Updates/bg-p/qlik-support-updates-blog

https://community.qlik.com/t5/Support-Updates/Qlik-Sense-Enterprise-for-Windows-New-Security-Patches-Available/ba-p/2108549

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510

Cheers,

Albert

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

diagonjope — Fri, 01 Dec 2023 00:54:26 GMT

Thank you, @Albert_Candelario !

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

w7 — Mon, 29 Apr 2024 15:59:58 GMT

Is this version affected? It is not listed?

13.82.4 20200717

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

Albert_Candelario — Wed, 01 May 2024 11:27:35 GMT

Hello @w7,

Thanks for posting.

Could you confirm the version by naming the "Month" "Year" and patch that you use?

Thanks in advance.

Cheers,

Albert

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

w7 — Wed, 01 May 2024 12:19:34 GMT

Version = 13.82.4

YYYYMMDD

Year = 2020

Month = 07

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

David_Friend — Wed, 01 May 2024 13:15:32 GMT

@w7 : "All prior versions of Qlik Sense Enterprise on Windows are affected, including releases such as May 2022, February 2022, and earlier."

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

Albert_Candelario — Thu, 02 May 2024 08:49:36 GMT

Thanks, please upgrade to version that does include the fix.

Cheers,

Albert

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

SudharshanK — Thu, 02 May 2024 18:53:11 GMT

@Albert_Candelario We are using Qlik Cloud in our organization. Has the cactus ransomware issue affected the cloud version as well? If so, has there been any patches applied to prevent this issue?

Re: "Qlik Sense Exploited in Cactus Ransomware Campaign": Is this true? Does Qlik have any security updates to deal with this?

David_Friend — Thu, 02 May 2024 18:56:11 GMT

From the article:

This issue only impacts Qlik Sense Enterprise for Windows. Other Qlik products including Qlik Cloud and QlikView are NOT impacted.