Firewall and VPN breaches by actor k0t expose 70,000+ credentials
According to The Hacker News, a joint investigation by Group-IB and NyxLab describes a large-scale campaign against exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The headline figure is more than 70,000 exposed credentials. The report attributes the activity to a threat actor tracked as k0t. This is a firewall and VPN credential-theft campaign; the source does not say it is tied to a single new flaw.
What we know
The researchers say operators in the campaign gained access to numerous organizations worldwide and tried to compromise some victims further, leading to persistent remote access and data exfiltration. The report attributes the activity to k0t, who also uses the aliases CryptoFeel, Member19 and QazWsxShop and was first seen in the wild on October 22, 2025.
- The actor is assessed to have connections to ransomware groups such as Qilin and The Gentlemen, and likely works as an initial access broker or affiliate.
- Dark web activity shows interest in buying exploit code and tools, and premium accounts for metadata search engines such as FOFA and ZoomEye.
- A significant share of compromises reportedly took place between February and June 2026, overlapping with a separate credential harvesting campaign codenamed FortiBleed.
Reported attack chain
- Reconnaissance with public scanning tools such as FOFA and ZoomEye to list internet-facing VPN and firewall appliances and build target lists.
- Initial access by exploiting known vulnerabilities, including CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass in Palo Alto Networks PAN-OS and Prisma Access), using scripts named “fortnew.py” and “exploit_2026_0257.py”, or by brute-forcing common username and password pairs.
- A foothold through an OpenConnect VPN connection.
- Post-exploitation: credential theft and enumeration of Active Directory, SMB and installed antivirus.
- Persistence through legitimate remote access tools (MeshCentral Agent, Atera, Teramind, AnyDesk) and the open-source adversary-emulation framework AdaptixC2.
- Exfiltration with Rclone to Wasabi S3 buckets and MEGA cloud drives.
The operators also used legitimate administrator and pentesting tools including NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz.
Who is affected
Victims are global and span many sectors, because targeting is indiscriminate: any exposed edge device is a candidate. By region, nearly 38% of victims are in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa, per the report. The names of affected organizations were not disclosed in the material we reviewed, and the full list of affected products and versions was not disclosed either.
What has not been confirmed
The link between k0t and Qilin or The Gentlemen is described as an assessment, not a confirmed relationship. We have not seen vendor statements from Fortinet or Palo Alto Networks in the source material, and the exact origin of the 70,000 credentials was not detailed in the excerpt we reviewed.
Why this matters
Analysis, not new facts. Edge devices sit on the network boundary and often hold credentials that unlock the wider environment. An initial access broker who lands a VPN session can resell it to ransomware affiliates, so a quiet credential compromise today can become an encryption event later. Brute-force access also means fully patched devices with weak or reused passwords are exposed. The remote access tools in the attack chain are legitimate software, so allow-lists and software inventories are a realistic way to spot the unexpected ones.
What to do
- Inventory internet-facing firewalls, VPN gateways and FortiWeb or PAN-OS/Prisma Access systems, and confirm each runs a vendor-fixed release for CVE-2025-64446 and CVE-2026-0257 where relevant.
- Reset credentials stored on or used by edge devices, including local admin, VPN and service accounts, and enforce MFA on VPN access.
- Review VPN and authentication logs for repeated failed logins, logins from unexpected countries, and new OpenConnect sessions.
- Hunt for unapproved MeshCentral, Atera, Teramind, AnyDesk or AdaptixC2 installs, and for Rclone use or traffic to Wasabi S3 and MEGA.
- Watch for Mimikatz, Impacket, NetExec, Kerbrute and PetitPotam activity against Active Directory, and alert on bulk outbound transfers.
- Restrict management interfaces so they are not reachable from the internet.
Related free tool: test how long a password would take to crack with our Password Strength Checker. It runs entirely in your browser and nothing you type is sent or stored.
