Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords

Original title: Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords

Cyber Security Newsby Tushar Subhra Dutta ()4 min read4 · 3 reads
Read at cybersecuritynews.com
Part of a story covered by 19 sourcesRansomware groups still exploit patched Palo Alto GlobalProtect flawMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.

A campaign linked to an operator known as k0t targets internet-facing Fortinet FortiGate and FortiWeb devices and Palo Alto Networks GlobalProtect portals to steal credentials and keep access. Group-IB and NyxLab, in a report published October 21, 2026, say operators scan exposed gear, exploit flaws or guess weak passwords, then pull configuration secrets, including LDAP records. They observed a custom tool using FortiWeb CVE-2025-64446 to create an administrator, password guessing on FortiGate, and attempts against GlobalProtect CVE-2026-0257. Some victims later appeared on ransomware leak sites; affiliation with those groups is unconfirmed.

Unconfirmed: Group-IB has not confirmed that k0t is affiliated with the ransomware groups whose leak sites later listed some victims.

Key facts
  • Researchers identified more than 70,000 exposed credentials, not all proven compromises.
  • FortiWeb CVE-2025-64446 is a path traversal that can run administrative commands.
  • FortiGate was attacked with common usernames and passwords, not that FortiWeb flaw.
  • CVE-2026-0257 can allow an unauthorized GlobalProtect VPN connection under specific PAN-OS settings.
  • Review found 28 device groups and 84 devices tied to one MeshCentral server.
Security assessment · AI, from the articleExploited in the wild

Impact: Stolen device, administrator and LDAP or Active Directory credentials

ProductAffected
Fortinet FortiWeb—
Fortinet FortiGate—
Palo Alto Networks GlobalProtectportals and gateways under specific PAN-OS settings
What to do
  1. 1.Confirm FortiGate, FortiWeb and GlobalProtect run fixed software and limit admin access.
  2. 2.Rotate credentials stored on possibly accessed appliances and review VPN and identity logs.
  3. 3.Enable FortiGate private-data encryption with an organization-controlled key.
Analyze CVE-2025-64446 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-64446CVE-2026-0257
ATT&CK
T1190 Exploit Public-Facing ApplicationT1110.001 Password GuessingT1552.001 Credentials In FilesT1003 OS Credential DumpingT1567.002 Exfiltration to Cloud Storage
Tags
fortigatefortiwebglobalprotectcredential-theftedge-devicesk0t
Vendors
FortinetPalo Alto Networks
Products
FortiGateFortiWebGlobalProtectPAN-OS
Threat actors
k0t
Malware
NetExecImpacketMimikatzMeshCentralAteraRclone
Organizations
Group-IBNyxLab

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-64446
Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution
9.892%KEVPoC
KEV
CVE-2026-0257
Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
7.897%KEVRansomware
KEV

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainagent.afahimsa.topirydsfsggvb[.]com IP address 62[.]60[.]135[.]64 URL hxxps://agent[.]afahimsa[.]top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3U
domainmesh.buttruyen.comransomware groups involved. k0t’s MeshCentral login page at mesh[.]buttruyen[.]com (Source – Group-IB) Organizations can read more about F
domainmeshcentral.girydsfsggvb.commesh[.]buttruyen[.]com IP address 62[.]60[.]131[.]43 Domain meshcentral[.]girydsfsggvb[.]com IP address 62[.]60[.]135[.]64 URL hxxps://agent[.]afahi
domainradesashar.com193[.]24[.]123[.]162 IP address 193[.]149[.]176[.]50 Domain radesashar[.]com IP address 193[.]169[.]194[.]21 Hash type Hash MD5 5318f2
domainsthyjk.com8[.]213:8888/clear-thinking_61.92.4_INSTALL.exe URL hxxps://sthyjk[.]com:8443/clear-thinking_61.92.4_INSTALL.exe IP address 162[.]
ipv4162.33.178.213IP address 64.94.85.14 IP address 168.100.11.99 URL hxxp://162[.]33[.]178[.]213:8888/clear-thinking_61.92.4_INSTALL.exe URL hxxps://s
ipv4162.33.179.249jk[.]com:8443/clear-thinking_61.92.4_INSTALL.exe IP address 162[.]33[.]179[.]249 IP address 193[.]24[.]123[.]162 IP address 193[.]149[
ipv4168.100.11.99149[.]187[.]81:1287/1.exe IP address 64.94.85.14 IP address 168.100.11.99 URL hxxp://162[.]33[.]178[.]213:8888/clear-thinking_61.92.4
ipv4193.149.176.50.]33[.]179[.]249 IP address 193[.]24[.]123[.]162 IP address 193[.]149[.]176[.]50 Domain radesashar[.]com IP address 193[.]169[.]194[.]
ipv4193.149.187.81SUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&in URL hxxp://193[.]149[.]187[.]81:1287/1.exe IP address 64.94.85.14 IP address 168.100.
ipv4193.169.194.21ess 193[.]149[.]176[.]50 Domain radesashar[.]com IP address 193[.]169[.]194[.]21 Hash type Hash MD5 5318f29ef434341d989d543b14fd2a48 S
ipv4193.24.123.16292.4_INSTALL.exe IP address 162[.]33[.]179[.]249 IP address 193[.]24[.]123[.]162 IP address 193[.]149[.]176[.]50 Domain radesashar[.]c
ipv462.60.131.43):- Type Indicator Domain mesh[.]buttruyen[.]com IP address 62[.]60[.]131[.]43 Domain meshcentral[.]girydsfsggvb[.]com IP address 62
ipv462.60.135.64131[.]43 Domain meshcentral[.]girydsfsggvb[.]com IP address 62[.]60[.]135[.]64 URL hxxps://agent[.]afahimsa[.]top/meshagents?id=4&me
ipv464.94.85.14ND&in URL hxxp://193[.]149[.]187[.]81:1287/1.exe IP address 64.94.85.14 IP address 168.100.11.99 URL hxxp://162[.]33[.]178[.]213:88
md5032473db4d66748eab524effe57a661da69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d MD5 032473db4d66748eab524effe57a661d SHA-1 b686a811ad89671fbdb448d65f79488d2e562265 SHA-256 4db6
md50dc1af7cfd336a7f075228defc730082881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e MD5 0dc1af7cfd336a7f075228defc730082 SHA-1 b39cf70a0194d32e00d7812c29ae1d6add77b823 SHA-256 8081
md513367fbba4344de87de418ab17de76f01e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d MD5 13367fbba4344de87de418ab17de76f0 SHA-1 f05daaf66b200672d679a5ced8b67d4b48a4906e SHA-256 552d
md5197f2621c80da7974c56d2ff1921e99460c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21 MD5 197f2621c80da7974c56d2ff1921e994 SHA-1 e47a2b7ca6a8c009962871dbb667d128ad6b6162 SHA-256 f9e9
md520dc8f1b8a313336c14e03bcb71ff6c871e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a MD5 20dc8f1b8a313336c14e03bcb71ff6c8 SHA-1 e2c96e603323d8fc7c08678b793d56554faa6914 SHA-256 1d1b
md55318f29ef434341d989d543b14fd2a48ar[.]com IP address 193[.]169[.]194[.]21 Hash type Hash MD5 5318f29ef434341d989d543b14fd2a48 SHA-1 6546801898d0b32f5050f49c5302f0366d630cc9 SHA-256 1582
md56f5d18157425aa9697913ae1310f588fda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e MD5 6f5d18157425aa9697913ae1310f588f SHA-1 bfd864ec0e6bd912f932e4f3ed80687736ee16e8 SHA-256 39c4
sha16546801898d0b32f5050f49c5302f0366d630cc91 Hash type Hash MD5 5318f29ef434341d989d543b14fd2a48 SHA-1 6546801898d0b32f5050f49c5302f0366d630cc9 SHA-256 158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd
sha1b39cf70a0194d32e00d7812c29ae1d6add77b8236f99cfaa0ba0b72e MD5 0dc1af7cfd336a7f075228defc730082 SHA-1 b39cf70a0194d32e00d7812c29ae1d6add77b823 SHA-256 808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af
sha1b686a811ad89671fbdb448d65f79488d2e562265964f6e03f5f04a6d MD5 032473db4d66748eab524effe57a661d SHA-1 b686a811ad89671fbdb448d65f79488d2e562265 SHA-256 4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c1
sha1bfd864ec0e6bd912f932e4f3ed80687736ee16e8e2a10b3bcbbd2a0e MD5 6f5d18157425aa9697913ae1310f588f SHA-1 bfd864ec0e6bd912f932e4f3ed80687736ee16e8 SHA-256 39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f9
sha1e2c96e603323d8fc7c08678b793d56554faa69149bd6042ee543278a MD5 20dc8f1b8a313336c14e03bcb71ff6c8 SHA-1 e2c96e603323d8fc7c08678b793d56554faa6914 SHA-256 1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964
sha1e47a2b7ca6a8c009962871dbb667d128ad6b61623b7ef06c932e2a21 MD5 197f2621c80da7974c56d2ff1921e994 SHA-1 e47a2b7ca6a8c009962871dbb667d128ad6b6162 SHA-256 f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a
sha1f05daaf66b200672d679a5ced8b67d4b48a4906e2c19c10423ac842d MD5 13367fbba4344de87de418ab17de76f0 SHA-1 f05daaf66b200672d679a5ced8b67d4b48a4906e SHA-256 552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7
sha256158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a2a48 SHA-1 6546801898d0b32f5050f49c5302f0366d630cc9 SHA-256 158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a MD5 20dc8f1b8a313336c14e03bcb71ff6c8 SHA-1 e2c96e603323d8fc
sha2561d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6df6c8 SHA-1 e2c96e603323d8fc7c08678b793d56554faa6914 SHA-256 1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d MD5 032473db4d66748eab524effe57a661d SHA-1 b686a811ad89671f
sha25639c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e588f SHA-1 bfd864ec0e6bd912f932e4f3ed80687736ee16e8 SHA-256 39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e MD5 0dc1af7cfd336a7f075228defc730082 SHA-1 b39cf70a0194d32e
sha2564db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d661d SHA-1 b686a811ad89671fbdb448d65f79488d2e562265 SHA-256 4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d MD5 13367fbba4344de87de418ab17de76f0 SHA-1 f05daaf66b200672
sha256552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a2176f0 SHA-1 f05daaf66b200672d679a5ced8b67d4b48a4906e SHA-256 552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21 MD5 197f2621c80da7974c56d2ff1921e994 SHA-1 e47a2b7ca6a8c009
sha256808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c0082 SHA-1 b39cf70a0194d32e00d7812c29ae1d6add77b823 SHA-256 808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c Note: IP addresses and domains are intentionally defanged (
sha256f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0ee994 SHA-1 e47a2b7ca6a8c009962871dbb667d128ad6b6162 SHA-256 f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e MD5 6f5d18157425aa9697913ae1310f588f SHA-1 bfd864ec0e6bd912
urlhttp://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe7/1.exe IP address 64.94.85.14 IP address 168.100.11.99 URL hxxp://162[.]33[.]178[.]213:8888/clear-thinking_61.92.4_INSTALL.exe URL hxxps://sthyjk[.]com:8443/clear-thinking_61.92.4_
urlhttp://193.149.187.81:1287/1.exe83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&in URL hxxp://193[.]149[.]187[.]81:1287/1.exe IP address 64.94.85.14 IP address 168.100.11.99 URL h
urlhttps://agent.afahimsa.top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&intral[.]girydsfsggvb[.]com IP address 62[.]60[.]135[.]64 URL hxxps://agent[.]afahimsa[.]top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&in URL hxxp://193[.]149[.]187[.]81:1287/1.exe IP address 6
urlhttps://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe]33[.]178[.]213:8888/clear-thinking_61.92.4_INSTALL.exe URL hxxps://sthyjk[.]com:8443/clear-thinking_61.92.4_INSTALL.exe IP address 162[.]33[.]179[.]249 IP address 193[.]24[.]123

From the original article

4 min read at cybersecuritynews.com

Internet-facing firewalls and VPN systems are under attack in a campaign that aims to steal credentials and gain lasting access to corporate networks. The activity targets FortiGate and FortiWeb devices from Fortinet, as well as Palo Alto Networks GlobalProtect portals. Once inside, operators can collect passwords stored in device configurations and use them to move […]

Cyber Security News

By Tushar Subhra Dutta · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.