k0t campaign exposes 70,000+ FortiGate, GlobalProtect credentials

Group-IB and NyxLab have published a joint investigation into a credential-harvesting campaign against internet-facing security appliances, exposing more than 70,000 credentials tied to network devices and LDAP dumps. The primary write-up is Group-IB's "stray cat" report; The Hacker News covered it October 23. The researchers name k0t as the likely lead operator and assess a possible — unconfirmed — tie to the Qilin and The Gentlemen ransomware groups, with k0t most plausibly acting as an initial access broker.

What's affected

The majority of targeted devices were Fortinet firewalls and Palo Alto GlobalProtect appliances. The report ties initial access to two vulnerabilities:

• CVE-2025-64446 — a relative path traversal in Fortinet FortiWeb.
• CVE-2026-0257 — an authentication bypass affecting PAN-OS GlobalProtect portals and gateways (the same flaw we covered in Qilin's hands).

Where a CVE wasn't used, operators brute-forced common username/password pairs. Many FortiGate compromises are dated February–June 2026. By unique domain, accounts from Asia-Pacific make up the largest share (37.6%); Group-IB cautions this is not evidence of deliberate regional targeting.

How they operate

Group-IB describes a scan-at-scale model, not per-target research:

1. Reconnaissance with FOFA and ZoomEye to enumerate exposed VPN and firewall appliances.
2. Initial access via CVE exploitation (scripts named fortnew.py and exploit_2026_0257.py) or credential brute force.
3. Foothold through an OpenConnect VPN connection into the compromised network.
4. Post-exploitation enumeration of Active Directory, SMB and the installed AV, plus further credential theft (NetExec, Impacket, noPac, Kerbrute, PetitPotam, Mimikatz).
5. Persistence via RMM tooling (MeshCentral, Atera, Teramind, AnyDesk) and the AdaptixC2 framework.
6. Exfiltration with Rclone to Wasabi S3 and MEGA.

Action checklist

1. Patch the edge first. If you run FortiWeb, apply the fix for CVE-2025-64446; if you run PAN-OS GlobalProtect, apply the fix for CVE-2026-0257. These are the documented entry points.
2. Assume credentials on exposed appliances are burned. Rotate local device, LDAP/AD bind, and VPN credentials for any appliance that was internet-facing during February–June 2026.
3. Hunt for the tradecraft: unexpected OpenConnect sessions, RMM agents (MeshCentral/Atera/Teramind/AnyDesk) you didn't deploy, AdaptixC2 beacons, and rclone transfers to Wasabi or MEGA.
4. Restrict management-plane exposure. GlobalProtect and FortiWeb admin interfaces should not be reachable from the open internet.

Context

This is the second large edge-device credential dump we've tracked in a month. Group-IB is explicit that it is distinct from the FortiBleed cluster — only negligible overlap in the compromised data. Two separate crews, same surface: Fortinet and Palo Alto appliances that organizations put on the public internet and then forget. The entry CVEs change; the exposure doesn't. Edge appliances are the front door, and brokers like k0t are industrializing the job of opening it for whoever pays.