k0t campaign breaches Fortinet and Palo Alto edge devices
The Hacker News reports that researchers have detailed a large-scale campaign against exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The headline puts the number of exposed credentials at over 70,000. A joint investigation by Group-IB and NyxLab says the operators gained access to numerous organizations worldwide, and the article describes persistent remote access and data exfiltration in some cases.
Any organization that exposes a VPN or firewall to the internet should treat this as a prompt to audit those devices now. Whether any specific vendor patch status or deadline applies has not been disclosed in the source material we reviewed.
What we know
According to The Hacker News, the activity is attributed to a threat actor known as k0t, who also uses the aliases CryptoFeel, Member19 and QazWsxShop. The actor was first seen in the wild on October 22, 2025. The researchers assess that k0t has connections to ransomware groups such as Qilin and The Gentlemen, and likely operates as an initial access broker or an affiliate.
The report says the actor showed interest on dark web forums in buying exploit code and tools, and premium accounts for metadata search engines such as FOFA and ZoomEye. A significant share of compromises took place between February and June 2026, which overlaps with another credential harvesting campaign codenamed FortiBleed.
The reported attack chain:
- Reconnaissance with scanning tools such as FOFA and ZoomEye to list internet-facing VPN and firewall appliances and build target lists.
- Initial access through known vulnerabilities, namely CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access), using Python scripts named “fortnew.py” and “exploit_2026_0257.py”, or brute-force attacks with common username and password pairs.
- A foothold through an OpenConnect VPN connection.
- Post-exploitation: enumeration of Active Directory, SMB and installed antivirus, plus further credential theft.
- Persistence with legitimate remote access tools (MeshCentral Agent, Atera, Teramind and AnyDesk) and the open-source adversary-emulation framework AdaptixC2.
- Exfiltration with Rclone to Wasabi S3 buckets and MEGA cloud drives.
The operators also used administrator and pentesting utilities, including NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz, to move deeper into victim networks.
Who is affected
Victims are global and span a broad range of sectors, because the targeting of exposed network devices is indiscriminate. By region, the report puts nearly 38% of victims in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa.
The data involved is stolen credentials and, in some cases, data exfiltrated after deeper compromise. The exact count of affected organizations, and which products and versions were compromised, are not disclosed in the text we have.
Why this matters
This section is our analysis, not new reporting. Edge devices sit outside most endpoint tooling, and stolen VPN credentials give an attacker a legitimate-looking way in. If the actor is an access broker, as the researchers assess, access gained here could be handed to ransomware affiliates, so a quiet intrusion today can become an encryption event later. The use of legitimate remote access tools makes the persistence stage easy to miss unless you inventory what is approved.
What has not been confirmed
The link between k0t and Qilin or The Gentlemen is an assessment by the researchers, described as likely, and not a confirmed relationship. The article excerpt we reviewed is truncated, so details of how k0t selects targets are not covered here.
What to do
- Inventory every internet-facing VPN and firewall appliance, and confirm FortiWeb and PAN-OS / Prisma Access are on versions that fix CVE-2025-64446 and CVE-2026-0257. Check the vendor advisories for fixed versions, which are not given in the source.
- Reset credentials for accounts that authenticate through these devices, and enforce multi-factor authentication.
- Review VPN logs for unexpected OpenConnect sessions and for bursts of failed logins that suggest brute forcing.
- Hunt for remote access tools you did not deploy (MeshCentral Agent, Atera, Teramind, AnyDesk) and for AdaptixC2.
- Look for Rclone use and outbound traffic to Wasabi S3 or MEGA, and for Active Directory enumeration tools such as NetExec, Impacket, Kerbrute and Mimikatz.
- If you find evidence of compromise, treat it as a full incident: rotate domain credentials and notify your incident response team.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.