Cactus Ransomware: Qlik Sense Exploitation

An internet-facing Qlik Sense analytics server is exploited and turned into the launch point for a Cactus ransomware intrusion. Within a day the operator persists with a rogue remote-access agent, dumps domain-admin credentials from memory, pivots by RDP to the domain controller and backup servers, steals engineering data to cloud storage, and deploys ransomware. Work the Qlik web logs, the endpoint process tree and the perimeter traffic to reconstruct the intrusion end to end and tell the abuse apart from a heavy baseline of normal analytics and remote-access activity.