Cybersecurity experts have uncovered a significant cyber attack targeting network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. This breach has exposed over 70,000 credentials, compromising numerous organizations worldwide.
Details of the Cyber Attack
According to a collaborative report by Group-IB and NyxLab, the attack was orchestrated by a threat actor identified as k0t, who also operates under the aliases CryptoFeel, Member19, and QazWsxShop. This cybercriminal has been active since October 2025, establishing itself as a significant player in the cyber threat landscape.
The investigation revealed that k0t collaborates with ransomware groups such as Qilin and The Gentlemen, possibly serving as an initial access broker or affiliate. The actor’s activities on the dark web show a keen interest in acquiring vulnerability exploit tools and premium accounts for search engines like FOFA and ZoomEye.
Global Impact and Victim Distribution
The campaign has impacted a diverse range of sectors globally, with a significant concentration of victims in the Asia Pacific region (38%), followed by Latin America (31.9%), Europe (15.8%), and the Middle East and North Africa (12.7%). Most of these breaches occurred from February to June 2026, coinciding with another credential harvesting operation called FortiBleed.
The attackers employed a multi-step strategy, starting with reconnaissance using public scanning tools to identify vulnerable VPN and firewall devices. They then exploited these devices using known vulnerabilities or brute-force attacks, securing initial access and establishing persistent remote connectivity through OpenConnect VPN.
Methods Employed in the Attack
Post-exploitation, the attackers performed additional credential theft and established persistence using legitimate remote access tools such as MeshCentral Agent, Atera, and AnyDesk. They also utilized an open-source adversary emulation framework known as AdaptixC2 for further infiltration.
Data exfiltration was carried out using Rclone to transfer data into cloud storage services like Wasabi S3 and MEGA. Additionally, legitimate administrator utilities such as NetExec and Impacket were used to penetrate deeper into corporate environments.
Group-IB and NyxLab highlighted that k0t targets devices based on their exposure rather than the specific industry, focusing on geographic priorities that start with the United States and Canada.
Implications and Recommendations
The link between k0t and ransomware groups is underscored by the appearance of many victims on data leak sites associated with these groups. However, the exact nature of their collaboration remains uncertain.
Researchers noted a negligible overlap between the compromised data from this activity and FortiBleed. Organizations are urged to address the vulnerabilities mentioned in the report to mitigate future risks.
As cybersecurity threats continue to evolve, it is crucial for organizations to strengthen their defenses and remain vigilant against such sophisticated attacks.
