k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 22, 2026
- Last mentioned2d ago
Timeline
3 articles · newest firstk0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
78
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
Related CVEs
by mentions- CVE-2025-6444692%9.8Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution
- CVE-2026-025797%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2019-66937%6.5Hard-Coded Encryption Key in Fortinet FortiOS Configuration Backups
Appears with
- FortiGateproduct · 3
- GlobalProtectproduct · 3
- FortiWebproduct · 3
- Palo Alto Networksvendor · 3
- Group-IBorganization · 3
- Fortinetvendor · 3
- AdaptixC2malware · 2
- NyxLaborganization · 2
- PAN-OSproduct · 2
- Rclonemalware · 1
- The Gentlementhreat actor · 1
- NetExecmalware · 1
- Impacketmalware · 1
- MeshCentralmalware · 1
- Qilinthreat actor · 1
- FortiGate Security Scannermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.