Global cyberattack campaign targets Fortinet and Palo Alto firewalls

Cybersecurity researchers have uncovered a global campaign targeting internet-facing network infrastructure, including Fortinet FortiGate and Palo Alto Networks GlobalProtect devices, with evidence of widespread unauthorised access, persistent remote connections and data theft.

A joint investigation by Group-IB and NyxLab attributes the activity to a threat actor known as k0t, who has also operated under the aliases CryptoFeel, Member19 and QazWsxShop.

• Cybersecurity researchers identified a large-scale campaign targeting exposed Fortinet and Palo Alto Networks devices through vulnerability exploitation and brute-force attacks.
• The threat actor k0t has been linked to more than 70,000 exposed credentials and network directory data, with victims concentrated in Asia Pacific, Latin America, Europe and the Middle East.
• Overlaps with victims of Qilin and The Gentlemen ransomware groups suggest possible initial access broker activity, although direct affiliations remain unconfirmed.

The campaign involves identifying exposed firewalls and virtual private network (VPN) appliances, exploiting known security vulnerabilities or weak credentials, and using legitimate administration tools to establish access to corporate networks.

Researchers identified more than 70,000 exposed credentials associated with network devices, alongside Lightweight Directory Access Protocol (LDAP) dumps and other compromised information.

Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration.

Group-IB and NyxLab

The findings also suggest potential connections between the campaign and ransomware operations, including Qilin and The Gentlemen, although investigators have not established the precise nature of those relationships.

k0t cyberattack campaign targets exposed network devices worldwide

The threat actor k0t was first observed in the wild on October 22, 2025, according to the joint investigation.

A substantial proportion of the identified compromises occurred between February and June 2026, a period that overlaps with another credential-harvesting campaign known as FortiBleed.

The attacks have affected organisations across multiple industries and geographical regions, reflecting an approach focused primarily on identifying accessible network appliances rather than selecting victims according to their business activities.

Asia Pacific accounted for nearly 38% of identified victims, followed by Latin America at 31.9%, Europe at 15.8%, and the Middle East and North Africa at 12.7%.

Investigators found that the actor’s stated geographical priorities began with the United States and Canada, followed by European countries and selected Asia Pacific markets.

The observed distribution indicates that the campaign extended across a wide range of regions, regardless of the industries operating the affected infrastructure.

“k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations,” the researchers said.

They added that the product and location of exposed equipment appeared more important to the attacker than the sector in which the targeted organisation operated.

Fortinet and Palo Alto vulnerabilities used for initial access

The attacks begin with reconnaissance against publicly accessible network infrastructure.

According to Group-IB and NyxLab, the operators use internet scanning and asset discovery platforms such as FOFA and ZoomEye to identify exposed VPN gateways, firewall appliances and potentially vulnerable systems.

These services allow users to search for connected devices and filter results according to technical characteristics, including product type.

Investigators also examined the threat actor’s activity on dark web marketplaces and forums, identifying an interest in purchasing vulnerability exploits, specialised attack tools and premium accounts for internet asset search engines.

Once potential targets have been identified, the operators attempt to gain access through known vulnerabilities or common username and password combinations.

The investigation identified exploitation activity involving CVE-2025-64446, a path traversal vulnerability affecting Fortinet FortiWeb, and CVE-2026-0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS and Prisma Access.

Researchers observed the use of customised Python scripts named “fortnew.py” and “exploit_2026_0257.py” in connection with these exploitation attempts.

The campaign also incorporates brute-force attacks using common credentials, providing another method of obtaining initial access where authentication protections are inadequate.

These techniques allow the operators to target different configurations and products within the broader population of exposed network devices.

Attackers use OpenConnect VPN and remote management tools

After obtaining access to a targeted device, the operators establish a network connection using OpenConnect VPN. The connection provides an entry point for additional activity inside the affected organisation’s environment.

Investigators observed attempts to enumerate Microsoft Active Directory infrastructure, Server Message Block (SMB) resources and installed antivirus products.

The objective of these activities is to gather information about the compromised network and identify opportunities for further access or credential theft.

The campaign also involves a collection of established administrative and penetration-testing utilities, including NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz. These tools can support network discovery, authentication testing, credential access and other activities within corporate infrastructure.

Their presence in the investigation reflects the operators’ reliance on existing security and administration software alongside customised exploitation scripts.

To maintain access, the attackers deploy legitimate remote monitoring and management tools, including MeshCentral Agent, Atera, Teramind and AnyDes.

Researchers also identified the use of AdaptixC2, an open-source adversary-emulation and command-and-control framework.

The combination of VPN connectivity, remote administration software and command-and-control capabilities enables the operators to maintain access to compromised environments after the initial intrusion.

Stolen data transferred to Wasabi S3 and MEGA cloud storage

The investigation documented data exfiltration involving Rclone, a file transfer and synchronisation utility.

Attackers used the software to move harvested information to external storage destinations, including Wasabi S3 buckets and MEGA cloud drives.

These services provide remote storage infrastructure that can receive information collected from compromised networks.

The researchers’ findings indicate that some intrusions progressed beyond the initial compromise of network edge appliances.

Operators attempted additional credential theft, internal reconnaissance and persistence activities before transferring data outside the affected environments.

More than 70,000 exposed credentials associated with network devices and LDAP dumps were identified in connection with the campaign.

The volume of exposed information suggests that the activity involved substantial credential collection, although the investigation does not establish that every credential originated from a separate compromised organisation.

The use of external cloud storage also forms part of the campaign’s broader pattern of maintaining access to affected networks and extracting information after gaining an initial foothold.

Possible connections to Qilin and The Gentlemen ransomware groups

Group-IB and NyxLab identified overlaps between organisations affected by the k0t campaign and victims subsequently listed on ransomware data leak websites.

The overlapping cases involved ransomware groups including Qilin and The Gentlemen. These findings suggest that the actor may operate as an initial access broker (IAB), obtaining access to corporate networks that could subsequently be used by other criminal groups.

Another possibility is that k0t participates in ransomware operations as an affiliate.

The investigators have not confirmed either arrangement. The overlap is based partly on the appearance of affected organisations on ransomware leak sites after activity associated with the campaign.

Such observations indicate a potential relationship but do not independently establish that k0t sold access, transferred credentials or directly participated in the subsequent ransomware incidents.

Group-IB and NyxLab therefore characterised the connection as a possible association with ransomware operators rather than a confirmed operational partnership.

Their findings nevertheless place the campaign within a wider set of criminal activities involving compromised network infrastructure, stolen credentials and subsequent attempts to access corporate systems.

Researchers examine possible links to FortiBleed campaign

The timing of the k0t attacks also overlaps with FortiBleed, a previously reported credential-harvesting campaign involving network edge infrastructure.

A substantial number of compromises attributed to k0t occurred between February and June 2026, when FortiBleed-related activity was also being observed.

Researchers investigated whether the two campaigns shared compromised data or operational connections.

The analysis found negligible overlap between the information associated with k0t and the previously identified FortiBleed dataset.

In particular, the investigation uncovered more than 70,000 exposed credentials and related LDAP information that had not been linked to previously identified threat actors, including those associated with FortiBleed.

The limited overlap complicates any direct attribution of the activity to the same operators.

Researchers nevertheless observed sufficient similarities and timing relationships to consider whether the k0t operation could represent a separate dataset, a subset of operators or a related access campaign within the broader FortiBleed-associated activity.

They also noted reports suggesting that multiple operators may be involved in the FortiBleed activity cluster.

The findings therefore leave open the possibility of shared methods or connections between some participants without establishing that the campaigns are identical.

Organisations urged to remediate network security vulnerabilities

The investigation illustrates how attackers can combine exposed network appliances, known vulnerabilities and legitimate remote administration software to compromise corporate environments.

The scale of the activity reflects the operators’ focus on identifying accessible systems rather than conducting extensive research into individual organisations before attempting an intrusion.

The two vulnerabilities highlighted in the report, CVE-2025-64446 and CVE-2026-0257, represent specific weaknesses that organisations should assess within their relevant Fortinet and Palo Alto Networks deployments.

Group-IB and NyxLab advised organisations to ensure that the vulnerabilities identified in the investigation are appropriately remediated.

The documented techniques also provide indicators for security teams investigating potentially compromised networks, including unexpected OpenConnect VPN connections, unauthorised remote management software, suspicious credential-access activity and unexplained transfers to external cloud storage.

Investigators emphasised that the full technical picture remains incomplete, particularly regarding potential coordination with ransomware operators and the relationship with FortiBleed.

Group-IB and NyxLab said they intend to publish a further technical report covering additional evidence, exposed attacker tooling, and the tactics, techniques and procedures observed during the investigation.

For now, the confirmed findings establish a widespread campaign involving vulnerable network infrastructure, more than 70,000 exposed credentials, persistent remote access and data exfiltration, with possible connections to ransomware operations still under investigation.