Researchers link k0t campaign to 70,000 exposed firewall credentials

Group-IB and NyxLab said on October 21 that they linked a campaign run by threat actor k0t to more than 70,000 exposed login records, including network-device passwords and LDAP directory information. The researchers cautioned that the total does not prove every credential was usable or that each listed organization was compromised.

The operation targeted internet-facing Fortinet FortiGate and FortiWeb appliances and Palo Alto Networks GlobalProtect systems. Attackers used public search platforms such as FOFA and ZoomEye to find reachable devices at scale, then tested them for software holes and weak passwords. On FortiWeb, they tried to exploit CVE-2025-64446, a directory traversal weakness that allows unauthenticated command execution through crafted HTTP or HTTPS requests; Group-IB observed a custom utility attempting to create an administrator account on vulnerable appliances. FortiGate devices are not affected by that FortiWeb flaw, so the operators instead tried common username and password pairs against exposed firewalls. GlobalProtect was targeted through CVE-2026-0257, an authentication bypass that affects certain portal and gateway configurations where authentication override cookies are turned on and a specific certificate setup is present. Palo Alto Networks separately confirmed active exploitation of CVE-2026-0257, but that confirmation does not establish that every observed attack belongs to k0t. Fortinet's advisory classifies CVE-2025-64446 as an improper access control problem in FortiWeb.

After gaining access, attackers could download FortiGate configuration files and recover stored administrator, LDAP and Active Directory credentials, partly by using a known default encryption key, according to Group-IB. They also relied on OpenConnect VPN connections, remote-management tools such as MeshCentral and Atera, AdaptixC2, NetExec, Impacket and Mimikatz to hold access and move through networks. The researchers found 28 active groups with 84 compromised devices reporting to a MeshCentral server. In some cases, data was copied to cloud storage with Rclone. A large share of FortiGate intrusions took place from February through June 2026.

Some victims later appeared on leak pages run by the Qilin and The Gentlemen ransomware groups, which may indicate that k0t sells network access, but Group-IB said the relationship is not confirmed. The researchers said the operators appear to function as initial access brokers. Unit 42 reported on October 19 that Qilin and Inc ransomware operators had tried to exploit CVE-2026-0257, with separate reports involving Settra, although an earlier Unit 42 inquiry saw no signs of attackers progressing further into compromised networks. The campaign data showed 37.6% of unique domains in Asia-Pacific, but the researchers cautioned that this may reflect the number of exposed devices in the region rather than a deliberate focus on Asian targets.

Group-IB said the k0t dataset barely overlaps with the separate FortiBleed cluster, and there is no evidence that the same attackers ran both operations; the figures are not comparable because k0t involves credentials while FortiBleed involves 86,644 compromised devices across 194 countries. Fortinet said FortiBleed attackers reused stolen credentials and guessed passwords, and that campaign did not involve a newly disclosed Fortinet vulnerability.

Defenders should verify whether their FortiGate, FortiWeb, and GlobalProtect appliances are reachable from the internet, apply fixes from vendors, limit management interfaces to trusted networks, and require multifactor authentication. Security teams should examine logs for new admin accounts, exported configurations, unusual VPN activity, repeated failed logins, and management connections from unknown sources, then rotate credentials stored in or linked to any potentially accessed appliance. Palo Alto Networks' advisory provides remediation for CVE-2026-0257, and Fortinet's advisory covers CVE-2025-64446.