The k0t Campaign: Enterprise Firewalls Breached, 70,000+ Credentials Exposed

Group-IB and NyxLab have published a joint investigation into a large-scale campaign targeting internet-facing network edge devices — Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect gateways. According to the researchers, the operators gained access to numerous organizations worldwide and, in several cases, achieved persistent remote access and data exfiltration.

The activity is attributed to a threat actor known as k0t (also using the aliases CryptoFeel, Member19, and QazWsxShop), first observed in the wild on October 22, 2025. He is assessed to have ties to the ransomware groups Qilin and The Gentlemen — likely acting as an initial access broker or affiliate. On dark web forums, k0t showed a marked interest in buying exploit code and premium accounts for metadata search engines such as FOFA and ZoomEye.

How the attack works

Victims span the globe and a broad range of sectors — a natural consequence of indiscriminate targeting. A significant share of the compromises occurred between February and June 2026, overlapping with another credential-harvesting campaign codenamed FortiBleed. Nearly 38% of victims are concentrated in Asia Pacific, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa.

The attack chain is methodical. Public scanners FOFA and ZoomEye were first used to compile lists of vulnerable appliances. Known flaws were then exploited — CVE-2025-64446 (a path traversal bug in FortiWeb) and CVE-2026-0257 (an authentication bypass in PAN-OS and Prisma Access) — via bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or through brute-forcing common credential pairs. After establishing a foothold over an OpenConnect VPN connection, the actor enumerated Active Directory, SMB shares, and installed antivirus solutions.

For persistence, the campaign relied on legitimate remote-access tools (MeshCentral, Atera, Teramind, AnyDesk) and the open-source adversary-emulation framework AdaptixC2. Harvested data was exfiltrated with Rclone into Wasabi S3 buckets and MEGA cloud drives. Familiar admin and pentesting utilities — NetExec, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz — were used to dig deeper into corporate networks.

Geography and scale

Researchers note that k0t selects targets by enumerating exposed appliances at scale rather than studying individual organizations. His stated priorities begin with the United States and Canada, followed by European countries and selected APAC markets. The product and location of a device therefore matter more than the industry of its owner.

The links to Qilin and The Gentlemen stem from the fact that many victims later appeared on those groups' leak sites, though the exact nature of the relationship remains unclear. Overlap with FortiBleed's compromised data is described as "negligible." In total, more than 70,000 credentials tied to network devices, along with LDAP dumps, have been identified. Organizations are advised to remediate all the vulnerabilities named in the report.

Source: The Hacker News