On November 28 2023, Arctic Wolf Labs reported on a new Cactus ransomware campaign which exploits publicly-exposed installations of Qlik Sense, a cloud analytics and business intelligence platform. While the focus of the attack was on Windows servers, Qlik is internet-facing and if breached, attackers can move laterally from SaaS-to-SaaS. The security vulnerabilities can be exploited by a remote, unauthenticated threat actor to do the following: