k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Original title: K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
Group-IB describes a k0t campaign against FortiGate, FortiWeb and Palo Alto GlobalProtect that steals credentials, maintains access and exfiltrates data. A custom scanner exploits CVE-2025-64446 on FortiWeb to create an administrator, brute-forces FortiGate, and decrypts stored secrets with the default FortiOS AES key tied to CVE-2019-6693. GlobalProtect access uses CVE-2026-0257 cookie forgery, followed by hands-on discovery and MeshCentral.
Unconfirmed: Connections to FortiBleed, Qilin and The Gentlemen are overlaps only; direct affiliations remain unconfirmed.
- Asia Pacific and Latin America account for the largest shares of identifiable victim domains.
- MeshCentral at mesh[.]buttruyen[.]com managed 84 endpoints in 28 active device groups.
- FortiGate brute-force logic pauses a locked target for 60 seconds before retrying.
- Overlaps with Qilin and The Gentlemen do not confirm a ransomware affiliation.
Impact: Stolen appliance and directory credentials and exfiltrated corporate data
| Product | Affected |
|---|---|
| Fortinet FortiWeb | — |
| Fortinet FortiGate | — |
| Palo Alto Networks GlobalProtect | — |
- 1.Apply vendor fixes for the named Fortinet and GlobalProtect flaws.
- 2.Review unexpected administrator accounts and unauthorized VPN or remote-management agents.
- 3.Rotate exposed directory credentials and end active GlobalProtect sessions after patching.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110 Brute ForceT1003 OS Credential DumpingT1567 Exfiltration Over Web Service
- Vendors
- FortinetPalo Alto Networks
- Products
- FortiWebFortiGateGlobalProtect
- Threat actors
- k0t
- Organizations
- Group-IB
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-6693 | Hard-Coded Encryption Key in Fortinet FortiOS Configuration Backups | 6.5 | 7% | KEVRansomware | KEV |
| CVE-2025-64446 | Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution | 9.8 | 92% | KEVPoC | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | agent.afahimsa.top | e current victim count. MeshAgents were distributed through agent[.]afahimsa[.]top, separating payload hosting from the management server. |
| domain | mesh.buttruyen.com | ccess. Researchers identified MeshCentral infrastructure at mesh[.]buttruyen[.]com managing 84 compromised endpoints across 28 active devi |
| ipv4 | 168.100.11.99 | 2 server IP address 64.94.85.14 AdaptixC2 server IP address 168.100.11.99 Note: IP addresses and domains are intentionally defanged ( |
| ipv4 | 62.60.131.43 | C2 Domain mesh[.]buttruyen[.]com MeshCentral C2 IP address 62[.]60[.]131[.]43 AdaptixC2 server IP address 64.94.85.14 AdaptixC2 ser |
| ipv4 | 64.94.85.14 | 2 IP address 62[.]60[.]131[.]43 AdaptixC2 server IP address 64.94.85.14 AdaptixC2 server IP address 168.100.11.99 Note: IP addresse |
From the original article
3 min read at gbhackers.com
A widespread campaign targeting FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances to steal credentials, establish persistent access, and exfiltrate corporate data. The investigation associates the activity with an operator known as k0t and identifies more than 70,000 exposed credentials across network-device records, LDAP dumps and other operational artifacts.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.