Cybersecurity researchers have uncovered a widespread cyberattack campaign targeting internet-facing network devices, including Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect VPN appliances. The attackers have reportedly gained access to organizations worldwide, stolen credentials, established persistent remote access, and exfiltrated sensitive data.
According to a joint investigation by Group-IB and NyxLab, the campaign is linked to a threat actor known as k0t, also identified by the aliases CryptoFeel, Member19, and QazWsxShop. The actor was first observed in October 2025 and is suspected of operating as an initial access broker or ransomware affiliate, with possible connections to the Qilin and The Gentlemen ransomware groups.
Researchers found that much of the activity occurred between February and June 2026, overlapping with another credential-harvesting operation known as FortiBleed. The campaign has affected organizations across multiple industries, reflecting the attackers’ focus on exposed network devices rather than specific sectors.
Asia-Pacific accounts for approximately 38% of the identified victims, followed by Latin America at 31.9%, Europe at 15.8%, and the Middle East and North Africa at 12.7%.
The attackers reportedly use public internet-scanning platforms such as FOFA and ZoomEye to identify exposed VPN and firewall appliances and build lists of potential targets. They then attempt to exploit known security flaws, including CVE-2025-64446, which affects Fortinet FortiWeb, and CVE-2026-0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS and Prisma Access. Investigators also observed brute-force attempts using commonly used username and password combinations.
The campaign uses custom Python scripts named fortnew.py and exploit_2026_0257.py to support exploitation attempts. After gaining initial access, the attackers establish VPN connections using OpenConnect and conduct further reconnaissance, including searches for Active Directory infrastructure, SMB resources, and installed antivirus software.
To maintain access to compromised systems, the operators deploy legitimate remote administration tools such as MeshCentral Agent, Atera, Teramind, and AnyDes. They have also been observed using AdaptixC2, an open-source command-and-control framework designed for adversary simulation and security testing.
The attackers reportedly rely on a range of administrative and penetration-testing utilities, including NetExec, Impacket, Kerbrute, Mimikatz, and PetitPotam, to expand their access within victim networks. Stolen information is then transferred using Rclone to Wasabi S3 storage buckets and MEGA cloud drives.
Group-IB and NyxLab said the threat actor appears to prioritize targets based on exposed network equipment and its location rather than the victim organization’s industry. The actor’s stated geographic priorities reportedly include the United States and Canada, followed by European countries and selected Asia-Pacific markets.
Investigators also found that some organizations compromised during the campaign were subsequently listed on the data leak sites of Qilin and The Gentlemen. However, the precise relationship between k0t and the ransomware groups remains unclear.
The researchers identified more than 70,000 exposed credentials associated with network devices and LDAP dumps connected to the campaign. They also found negligible overlap between the compromised data in this operation and the FortiBleed activity, suggesting that the incidents may involve separate datasets, different operators, or related access operations.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Organizations are advised to review internet-facing firewall and VPN appliances, apply available security updates for affected products, disable unnecessary external access, and enforce multifactor authentication where supported. Security teams should also investigate suspicious VPN connections, unexpected remote administration tools, unusual credential use, and unauthorized data transfers to cloud storage services.
