Cybersecurity experts are warning about a new wave of attacks targeting internet-facing firewalls and VPN systems. The campaign, which focuses on stealing credentials and gaining unauthorized access to corporate networks, has been observed exploiting vulnerabilities in FortiGate and FortiWeb devices from Fortinet, as well as Palo Alto Networks GlobalProtect portals.
Targeted Devices and Methods
Attackers are focusing on FortiGate and FortiWeb devices, along with Palo Alto GlobalProtect portals, to harvest stored passwords and infiltrate deeper into affected networks. Notably, the campaign is linked to a group identified as k0t, with research conducted by Group-IB and NyxLab uncovering its widespread impact across various sectors and regions.
The investigation has revealed over 70,000 exposed credentials, including network-device and LDAP records. However, researchers caution that this number does not necessarily indicate successful breaches for all uncovered credentials.
Vulnerabilities and Exploits
Group-IB’s report, published on October 21, 2026, details how attackers identify vulnerable network equipment using public search services. They exploit known software vulnerabilities or employ weak password guessing techniques to gain access. Among the vulnerabilities targeted is CVE-2025-64446, a path traversal flaw in FortiWeb devices, which allows unauthorized command execution.
Operators have been observed using a custom tool to exploit this flaw, creating new administrator accounts. Although FortiGate devices are not susceptible to this specific flaw, attackers attempt to gain access using common username and password combinations.
Preventative Measures and Recommendations
Organizations are urged to verify whether their FortiGate, FortiWeb, and GlobalProtect systems are internet-exposed and ensure they are running patched software versions. Restricting administrative access to trusted networks and regularly reviewing logs for any unusual activity is also recommended.
Security teams should investigate any potential breaches by examining connected accounts and systems, rotating stored credentials, and analyzing VPN and identity logs for suspicious activities. Palo Alto Networks and Fortinet have provided advisories with remediation instructions for the identified vulnerabilities, CVE-2026-0257 and CVE-2025-64446, respectively.
In conclusion, the threat posed by these ongoing attacks highlights the importance of robust security measures and regular system updates. Organizations must remain vigilant to protect their networks from unauthorized access and potential data breaches.
