Researchers have uncovered a sweeping cyberattack targeting exposed network edge devices—specifically Fortinet FortiGate and Palo Alto GlobalProtect firewalls—that has exposed more than 70,000 credentials. The breach is connected to a threat actor known as k0t (also known by aliases like CryptoFeel, Member19, and QazWsxShop), uncovered in a joint investigation by Group-IB and NyxLab.
Who’s Behind It and What’s the Motive?
The attacker, first observed in late October 2025, appears to act as an initial access broker or possibly an affiliate of established ransomware groups such as Qilin and The Gentlemen. Their operations involve acquiring exploit tools, vulnerability code, and even metadata from search services like FOFA and ZoomEye—suggesting a high degree of sophistication and intent to compromise network devices at scale.
The victim pool is highly varied: organizations from across the globe in different sectors. Between February and June 2026, the actors launched multiple attacks, overlapping with another breach campaign called FortiBleed. But despite timing and similarities, analysts say this is a distinct set of intrusions rather than a simple extension of FortiBleed.
Attack Chain: From Scan to Exfiltration
The group’s workflow begins with scanning the internet to locate unprotected firewalls and VPNs. Attackers then filter those devices by model and vendor to determine viable targets. Once identified, the devices are breached either via exploitation of known vulnerabilities—such as CVE-2025-64446 in FortiWeb, a path traversal bug, or CVE-2026-0257, an authentication bypass flaw in Palo Alto’s PAN-OS and Prisma Access—or through brute force using common credential combinations and custom Python tools (“fortnew.py,” “exploit_2026_0257.py”).
After gaining access, the attackers use OpenConnect to establish a foothold, then move laterally within victims’ environments by harvesting credentials, accessing Active Directory and SMB shares, and probing antivirus installations. To maintain persistence, they install or leverage legitimate remote-access or monitoring tools such as MeshCentral, Atera, Teramind, AnyDesk, and an adversary-emulation framework called AdaptixC2.
For exfiltration, stolen data—including device credentials and LDAP dumps—is uploaded via rclone to cloud storage platforms like Wasabi’s S3 buckets and MEGA drives. To deepen the intrusion, operators use post-exploitation tools like NetExec, Impacket, Mimikatz, Kerbrute, PetitPotam, and similar software often exploited in red-team or malware contexts.
Geographic Spread and Impact
The attack’s global reach is vast: nearly 38% of victims are in the Asia-Pacific region; Latin America accounts for around 32%; Europe about 16%; and the Middle East & North Africa roughly 13%. The strategy appears less about targeting specific industries and more about striking any vulnerable external network device.
Although many of the compromised networks later surfaced under ransomware group data leak sites—implying a possible handoff or collaboration—the exact relationship between k0t and those ransomware gangs remains unclear. What is clear, however, is that this credential leak appears to be largely separate from FortiBleed, contributing additional datasets rather than merely duplicating exposure.
The exposed haul totals over 70,000 credentials tied to network devices and LDAP servers. Organisations with affected devices are being urged to patch the aforementioned vulnerabilities immediately and ensure network edge devices are securely configured and monitored.
Why it matters: This breach underscores the persistent danger posed by unpatched external-facing infrastructure. Firewalls and VPNs—critical first lines of defense—are being leveraged to bypass deeper security layers, exacting significant risk globally. For businesses, keeping firmware current, minimizing internet exposure of edge devices, and enforcing strong authentication mechanisms are no longer optional but imperative. Monitoring for signs of brute-force and credential misuse, plus anomaly detection in access logs, will be essential. Move fast and act decisively before more credentials leak.
