Organizations using Fortinet’s FortiWeb and FortiGate appliances, along with Palo Alto Networks’ GlobalProtect portals, are now under coordinated attack aimed at stealing credentials, according to a report released October 21, 2026. The campaign, attributed to an operator known as k0t and tracked by cybersecurity firms Group-IB and NyxLab, spans multiple industries and geographical regions.
How the Breach Works
The attackers begin by searching for network firewalls and VPN endpoints exposed to the internet. Once a potential target is located, they attempt to exploit vulnerabilities or brute-force weak credentials to gain access. FortiWeb appliances are especially at risk from a path traversal vulnerability, CVE-2025-64446, which allows unauthenticated attackers to execute administrative commands via crafted web requests. Conversely, FortiGate units are generally attacked through tried-and-true password guessing, rather than this specific FortiWeb flaw.
Palo Alto Networks’ GlobalProtect portals are also under attack, particularly through CVE-2026-0257, an authentication bypass issue that under certain configurations permits unauthorized VPN access.
Once Inside the Network
When attackers gain access, their goal is to harvest credentials stored in device configuration files, which may include administrator accounts and LDAP or Active Directory credentials. A known default encryption key was used to decrypt some of this data, meaning exposure of configuration files could lead to disclosure of sensitive passwords rather than merely access-management concerns.
The attackers use legitimate tools—such as NetExec, Impacket, and Mimikatz—and remote-management software like MeshCentral and Atera to deepen their foothold. In numerous cases, networks show evidence of persistent access, including compromised devices being managed via compromised remote servers. In some instances, data has been exfiltrated to cloud storage using Rclone, and several victims later appeared on ransomware leak sites, though the report did not establish a direct link between k0t and any ransomware groups.
The total number of exposed credentials and related data exceeds 70,000, encompassing network-device credentials and LDAP records. That said, not all exposed credentials are confirmed to have been successfully used.
What Organizations Should Do
Security teams should start by scanning their networks to identify any FortiWeb, FortiGate, or GlobalProtect devices exposed to the internet. They must ensure that all systems are patched to eliminate CVE-2025-64446 and CVE-2026-0257 vulnerabilities. Access to administration interfaces should be restricted to trusted IPs or networks.
It’s also critical to monitor for red flags such as: the creation of unexpected administrator accounts; configuration exports; unusual login sessions or failures; VPN activity from unrecognized sources; and management access from unexpected locations. For devices that may have been compromised, credentials stored in or linked to them should be rotated, and teams should also review identity and endpoint logs for follow-on misuse.
Additionally, FortiGate administrators are urged to check whether private-data encryption is enabled using an organization-controlled key. Absence of such protections doesn’t guarantee that a device is safe; defenders should correlate events across appliances, VPNs, identity services, and endpoints.
Indicators of compromise include domains like mesh[.]buttruyen[.]com and meshcentral[.]girydsfsggvb[.]com; several IP addresses such as 62[.]60[.]131[.]43, and URLs hosting executables masquerading as installers.
This operation illustrates the ongoing vulnerability of edge VPN, firewall, and remote-access infrastructure. Attackers can rapidly move from external exposure to internal credential compromise and long-term access. The risk isn’t just breach of a device—it’s exposure of the broader network. Keeping Internet-facing systems patched, locked down, monitored, and encrypted is essential in preventing small misconfigurations from facilitating deep compromise.
