Habla con un experto
PreciosNoticiasHabla con un experto
Volver a la sala de prensa
Amenazas

k0t Campaign Hits FortiGate, FortiWeb and GlobalProtect to Harvest Credentials

An operator tracked as k0t is exploiting FortiWeb and GlobalProtect flaws and brute-forcing FortiGate firewalls to steal stored credentials and move deeper into corporate networks. Here's what to check and fix now.

4T4Tify Team4Tify
Oct 22, 2026·5 min de lectura
k0t Campaign Hits FortiGate, FortiWeb and GlobalProtect to Harvest Credentials

k0t Campaign Hits FortiGate, FortiWeb and GlobalProtect to Harvest Credentials

Internet-facing firewalls and VPN gateways are once again the front door. Group-IB, working with NyxLab, has documented a campaign tied to an operator tracked as k0t that goes after Fortinet FortiGate and FortiWeb appliances and Palo Alto Networks GlobalProtect portals, with one clear goal: pull credentials out of the edge device and use them to get deeper into the corporate network.

What happened

The playbook is opportunistic and runs at scale. The operators use public internet-scanning services to build lists of exposed VPN portals and firewalls, then work through those lists looking for a way in:

  • FortiWeb – exploitation of CVE-2025-64446, a path traversal / improper access control flaw that lets an unauthenticated attacker run administrative actions through crafted requests. The researchers saw a custom tool using it to create a new admin account.
  • FortiGate – not affected by the FortiWeb bug; here the operators fall back on brute-forcing common username and password combinations.
  • GlobalProtect – attempts to exploit CVE-2026-0257, an authentication bypass that, under certain PAN-OS configurations, can allow an unauthorized VPN connection.

Once on a FortiGate, the attackers can export the device configuration and recover the secrets stored in it, including admin credentials and LDAP / Active Directory service accounts. Group-IB reports that a known default encryption key was used to decrypt some of those stored secrets.

The investigation counted more than 70,000 exposed credentials and related records, including network-device logins and LDAP data. The researchers are careful to note that this figure does not mean every credential led to a successful compromise.

After the foothold

With valid credentials and VPN access, the intruders lean on tools that also show up in everyday IT work: NetExec, Impacket and Mimikatz for discovery and credential theft, plus remote-management software such as MeshCentral and Atera for persistence. One MeshCentral server alone was linked to 28 active device groups and 84 compromised machines. In some intrusions, data was copied out to cloud storage with Rclone.

Some victims later appeared on ransomware leak sites. Group-IB has not confirmed that k0t is directly affiliated with those ransomware groups, so treat any link as unproven.

Why it matters

Edge appliances hold the keys to everything behind them. A stolen FortiGate config is not just a device problem – it can hand over directory credentials that remain valid long after the original flaw is patched. And because the follow-on tooling looks like normal admin activity, reviewing events one at a time will often miss it.

What to do

  1. Inventory your edge. Confirm which FortiGate, FortiWeb and GlobalProtect interfaces are reachable from the internet, and take management interfaces off the public internet or restrict them to trusted networks.
  2. Patch. Apply Fortinet's fix for CVE-2025-64446 and Palo Alto Networks' remediation guidance for CVE-2026-0257.
  3. Hunt for signs of access. Look for unexpected admin accounts, configuration exports, unusual VPN sessions, bursts of failed logins and management logins from unfamiliar locations.
  4. Assume exposed configs leaked passwords. If a device may have been accessed, rotate every credential stored in or tied to it – especially LDAP/AD service accounts – and review VPN and identity logs for follow-on activity.
  5. Use your own encryption key. On FortiGate, check that private-data encryption is enabled with an organization-controlled key rather than the default.
  6. Watch for "legitimate" tools. Flag new MeshCentral, Atera or other RMM agents and Rclone transfers you didn't deploy. The researchers published indicators of compromise; load them into your SIEM or TIP – but remember that no IoC match does not prove a clean network.

Campaigns like this start with a simple question: which of your devices can an attacker see from the internet? That is exactly what our Attack Surface Management service answers continuously – mapping exposed VPN portals, firewalls and admin interfaces and flagging known-vulnerable versions before someone else's scanner finds them.

Source: this summary is based on coverage by Cyber Security News of research by Group-IB and NyxLab (report dated 21 October 2026).

COMPARTIR