Cybercriminals have compromised network firewalls at organizations across the globe and stolen more than 70,000 credentials from edge devices and corporate directories, according to a joint investigation published by Group-IB and NyxLab. The campaign targeted exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, with attackers gaining persistent remote access and siphoning data from numerous victims. The threat actor behind the operation, known as k0t, has been active since October 2025 and appears to work as an initial access broker with ties to ransomware gangs Qilin and The Gentlemen.
The bulk of the breaches occurred between February and June 2026, overlapping with another credential theft operation called FortiBleed. Nearly 38% of compromised organizations are located in the Asia Pacific region, while Latin America accounts for 31.9% of victims, Europe represents 15.8%, and the Middle East and North Africa make up 12.7%. The campaign hit targets across a wide range of industries, reflecting the attackers' indiscriminate approach to selecting victims based on exposed devices rather than specific sectors. The threat actor k0t, who also uses the aliases CryptoFeel, Member19, and QazWsxShop, has demonstrated interest in buying exploit code and premium subscriptions to metadata search platforms like FOFA and ZoomEye through dark web channels.
The researchers found that "k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations." The attacker's stated geographic focus begins with the United States and Canada, then extends to European nations and certain Asia Pacific markets. According to the investigation, "the product and location of an exposed device therefore appear to matter more than the industry of the organization operating it, consistent with the broad range of victims observed in this campaign." The connection between k0t and the ransomware groups stems from the fact that many breached organizations later appeared on Qilin and The Gentlemen data leak sites, though the precise nature of this relationship remains unclear.
The attack sequence begins with reconnaissance using public scanning tools to identify internet-facing VPN and firewall devices, followed by exploitation through known security flaws including CVE-2025-64446, a path traversal vulnerability in FortiWeb, and CVE-2026-0257, an authentication bypass weakness in Palo Alto Networks PAN-OS and Prisma Access. The attackers deploy custom Python scripts or conduct brute-force attacks using common login combinations to gain initial entry. Once inside, they establish footholds through OpenConnect VPN connections and plant legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, along with the open-source AdaptixC2 framework. The threat actor then uses administrator and penetration testing utilities including NetExec, SoftPerfect, Impacket, and Mimikatz to move laterally through corporate networks and harvest additional credentials from Active Directory and SMB systems, before uploading stolen data to Wasabi S3 buckets and MEGA cloud storage using Rclone. The report advises organizations to remediate the vulnerabilities cited in the investigation, particularly as the exposed credential dataset shows minimal overlap with FortiBleed, suggesting separate operator groups may be conducting related access operations within the broader campaign. For companies relying on perimeter defenses to protect internal networks, the shift from surgical targeting to automated exploitation at scale represents a fundamental change in how initial access is commoditized and sold. When the decision to attack depends more on what scanning tools reveal than who the victim is, traditional assumptions about risk profiles and threat modeling may no longer protect organizations the way security leaders expect.