k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Original title: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
Group-IB and NyxLab describe a campaign by k0t, also known as CryptoFeel, Member19 and QazWsxShop, against exposed Fortinet and Palo Alto network-edge devices worldwide. Operators scanned with FOFA and ZoomEye, exploited CVE-2025-64446 and CVE-2026-0257 or guessed passwords, then used OpenConnect, remote-access tools and AdaptixC2. Researchers link more than 70,000 device and LDAP credentials to the activity. Many victims later appeared on Qilin and The Gentlemen leak sites, but that connection is unclear.
Unconfirmed: Researchers say the exact link between k0t and Qilin or The Gentlemen is unclear.
- About 38% of victims were in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa.
- Scripts named fortnew.py and exploit_2026_0257.py were used for the two flaws.
- Persistence tools included MeshCentral, Atera, Teramind, AnyDesk and AdaptixC2.
- Data was copied with Rclone to Wasabi S3 and MEGA.
- Overlap with the FortiBleed credential-harvesting cluster was described as negligible.
Impact: Initial access, persistent remote control and credential and data theft
| Product | Affected |
|---|---|
| Fortinet FortiWeb | — |
| Palo Alto Networks PAN-OS | — |
| Palo Alto Networks Prisma Access | — |
- 1.Remediate CVE-2025-64446 on FortiWeb and CVE-2026-0257 on PAN-OS and Prisma Access.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110 Brute ForceT1219 Remote Access ToolsT1567.002 Exfiltration to Cloud StorageT1596 Search Open Technical Databases
- Vendors
- FortinetPalo Alto Networks
- Threat actors
- k0tQilinThe Gentlemen
- Malware
- AdaptixC2
- Countries
- United StatesCanada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-64446 | Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution | 9.8 | 92% | KEVPoC | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.