Hackers Exploit Exposed Firewalls and VPNs, Stealing Over 70,000 Credentials
A widespread campaign targeting exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices has resulted in the compromise of over 70,000 credentials, impacting organizations globally.
A sophisticated and large-scale cyber campaign has been actively exploiting internet-facing network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the exposure of more than 70,000 credentials. The campaign, detailed in a joint investigation by Group-IB and NyxLab, has compromised numerous organizations worldwide, with some victims facing further attempts at deeper compromise, including persistent remote access and data exfiltration.
The threat actor behind this widespread exploitation is identified as 'k0t', also known by aliases such as CryptoFeel, Member19, and QazWsxShop. This actor first appeared in the wild around October 22, 2025, and is believed to have connections with ransomware groups like Qilin and The Gentlemen, potentially operating as an initial access broker or an affiliate. Evidence suggests k0t actively seeks vulnerability exploit code and premium accounts for metadata search engines like FOFA and ZoomEye to identify targets.
The campaign's victims are global and span various sectors, a consequence of the indiscriminate targeting of exposed network devices. A significant period of compromise activity occurred between February and June 2026, which notably overlaps with another credential harvesting campaign known as FortiBleed. Geographically, nearly 38% of victims are located in the Asia Pacific region, followed by Latin America (31.9%), Europe (15.8%), and the Middle East and North Africa (12.7%).
The attack methodology involves several stages. Initially, threat actors conduct reconnaissance using public scanning tools to enumerate internet-facing VPN and firewall appliances, filtering by product to create target lists. They then attempt to exploit these devices through known vulnerabilities, such as CVE-2025-64446 in FortiWeb or CVE-2026-0257 in Palo Alto Networks PAN-OS, using custom Python scripts, or resort to brute-force attacks with common credentials to gain initial access.
Upon gaining a foothold, attackers establish persistence via OpenConnect VPN connections. Post-exploitation activities include enumerating Active Directory, SMB, and installed antivirus solutions, followed by establishing further persistence using legitimate remote access tools like MeshCentral Agent, Atera, and Teramind, or the adversary-emulation framework AdaptixC2. Data exfiltration is then carried out using Rclone to cloud storage services like Wasabi S3 buckets and MEGA.
The campaign also leverages legitimate administrator and penetration testing utilities, including NetExec, SoftPerfect, Impacket, and Mimikatz, to deepen their access within victim networks. Researchers noted that k0t prioritizes targets based on the presence and location of exposed network appliances rather than the industry of the operating organization, aligning with the diverse range of victims observed.
Links to ransomware groups like Qilin and The Gentlemen are inferred from the fact that many victims of k0t's campaign were later listed on these groups' data leak sites, though the exact nature of this relationship remains unclear. While there is a 'negligible overlap' with the FortiBleed campaign, the identified 70,000+ exposed credentials, including network device credentials and LDAP dumps, suggest a distinct but potentially related operation.
Organizations are strongly advised to ensure that any vulnerabilities mentioned in this report are promptly remediated. This includes patching affected devices, reviewing access logs for suspicious activity, and implementing robust credential management practices to mitigate the risk of further exploitation.