k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
Stories per day · 30 days
4 RSS
Relatedqilin6ransomware6pan-os5authentication-bypass3palo-alto3credential-theft2fortigate2fortiweb2k0t2cve-2026-02571edge-devices1litellm1meshcentral1mfa-bypass1nodejs1php1rat1supply-chain1
15 stories, newest first · one card per story
Stories tagged #globalprotect
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
2
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
2
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
1
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
7
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
9
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability
Qilin and Settra ransomware gangs actively exploit Palo Alto GlobalProtect auth bypass CVE-2026-0257 to hijack VPN sessions and breach networks.
11
Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access
Qilin and Settra are exploiting Palo Alto GlobalProtect CVE-2026-0257 for unauthorized VPN access.
10
Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks
Operation Master exploited GlobalProtect CVE-2026-0257, deployed AdaptixC2, and ran large-scale credential theft and invoice fraud.
5
Hackers Exploit GlobalProtect Flaw and Turn Stolen Data Into 2.4 Million Fraud Messages
Criminals exploited a GlobalProtect bypass, stole customer records, and sent 2.4 million fake bills.
5
UCQ Leak, Israeli GlobalProtect Access, Digital Nirvana Dump, 32baar, and Ghorer Bazar
SOCRadar flags underground posts selling an alleged Universidad Cuauhtémoc database, Israeli GlobalProtect VPN access, and Digital Nirvana data dumps.