Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

k0t Campaign Hits Fortinet and Palo Alto Edge Devices, 70,000+ Credentials Exposed

A threat actor dubbed k0t has been mass-exploiting exposed FortiGate, FortiWeb and GlobalProtect appliances to break into corporate networks worldwide, with links to Qilin and The Gentlemen ransomware.

4T4Tify Team4Tify
Oct 24, 2026·5 min read
k0t Campaign Hits Fortinet and Palo Alto Edge Devices, 70,000+ Credentials Exposed

k0t Campaign Hits Fortinet and Palo Alto Edge Devices, 70,000+ Credentials Exposed

A financially motivated threat actor tracked as k0t has spent the past year systematically breaking into internet-facing firewalls and VPN gateways — chiefly Fortinet FortiGate/FortiWeb and Palo Alto Networks GlobalProtect — and turning that access into full corporate network compromise. Investigators have tied more than 70,000 exposed credentials, along with network-device configuration data and LDAP dumps, to the operation.

What happened

The findings come from a joint investigation by Group-IB and NyxLab. The actor, also known as CryptoFeel, Member19 and QazWsxShop, was first observed on 22 October 2025. Its playbook is opportunistic rather than tailored: k0t picks victims by the device they expose, not by who they are.

The attack chain, as described by the researchers:

  1. Mass reconnaissance — internet search engines such as FOFA and ZoomEye are used to list exposed VPN and firewall appliances, filtered by product into target lists.
  2. Initial access — known flaws are exploited with custom Python scripts, notably CVE-2025-64446 (path traversal in FortiWeb) and CVE-2026-0257 (authentication bypass in PAN-OS GlobalProtect and Prisma Access). Where no flaw applies, the actor falls back to brute-forcing common usernames and passwords.
  3. Foothold — an OpenConnect VPN session into the victim network.
  4. Discovery and credential theft — enumeration of Active Directory, SMB shares and installed security tools, using common admin/pentest utilities (NetExec, Impacket, Kerbrute, noPac, PetitPotam, Mimikatz and others).
  5. Persistence — legitimate remote-management tools (MeshCentral, Atera, AnyDesk, Teramind) plus the open-source AdaptixC2 framework.
  6. Exfiltration — data shipped out with Rclone to Wasabi S3 buckets and MEGA.

Victims span many sectors. Roughly 38% are in Asia-Pacific, about 32% in Latin America, close to 16% in Europe and about 13% in the Middle East and North Africa. Much of the activity took place between February and June 2026.

Why it matters

Investigators assess that k0t is linked to the Qilin and The Gentlemen ransomware operations — several k0t victims later appeared on those groups' leak sites — and that it may act as an initial access broker or an affiliate. The exact relationship has not been confirmed, and the researchers found only a negligible data overlap with the separate FortiBleed credential-harvesting activity from the same period.

The lesson is uncomfortable but simple: if a vulnerable or weakly protected edge device is visible from the internet, you are on someone's list. Industry and company size barely factor in.

What to do

  • Patch edge devices first. Confirm FortiWeb is fixed for CVE-2025-64446 and PAN-OS / GlobalProtect / Prisma Access for CVE-2026-0257. Treat any device that was exposed while unpatched as potentially compromised.
  • Kill password-only VPN access. Enforce MFA on every VPN and firewall admin login, disable default and shared accounts, and alert on brute-force bursts.
  • Rotate credentials tied to network devices and directory services, especially if configs or LDAP data could have been read.
  • Hunt for the toolset. Look for unexpected OpenConnect sessions, unapproved RMM tools (MeshCentral, Atera, AnyDesk, Teramind), AdaptixC2 artifacts and Rclone traffic to Wasabi or MEGA.
  • Restrict management interfaces so admin portals are never reachable from the public internet.

Attackers here start from the same view any outsider has: what your organization exposes online. Our Attack Surface Management service continuously maps that view — internet-facing VPNs, firewalls and admin portals, their versions and known CVEs — so a vulnerable gateway is flagged to your team before it lands on someone else's target list.

Reporting based on research by Group-IB and NyxLab, as covered by The Hacker News.

SHARE