The firewall at the edge of your network exists to keep attackers out. A new joint investigation from Group-IB and NyxLab describes an actor who has spent the past year going after those firewalls first. The actor goes by the handle k0t. Researchers say k0t exploited and brute-forced exposed Fortinet FortiGate, Fortinet FortiWeb and Palo Alto Networks GlobalProtect appliances, and that more than 70,000 exposed credentials were identified in connection with the campaign. The researchers say the actor also set up persistent access inside victim networks. Many of those organizations were later named on ransomware leak sites.

Group-IB published its findings on October 21 under the title "Stray Cat, Open Doors." It says a deeper technical report will follow. Here is what is known so far and what defenders should do with it.

Who is k0t?

According to reporting by The Hacker News on the Group-IB research, k0t also operates under the aliases CryptoFeel, Member19 and QazWsxShop, and was first observed on October 22, 2025. Group-IB itself describes k0t as likely one of the main operators and says the activity appears to involve multiple people. The sources do not tie the actor to any nation-state, and none is suggested here.

Victims are spread across the world. The Hacker News reports that nearly 38% are in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa. Group-IB cautions that this spread should not be read as deliberate regional targeting; it may simply reflect where poorly configured devices are exposed to public scanning. Group-IB also says many of the FortiGate compromises it could date took place between February and June 2026.

How did the intrusions work?

The campaign used two methods to get in: exploiting known vulnerabilities, and brute-forcing logins on appliances exposed to the internet. Group-IB says the operators find targets in bulk by scanning for internet-facing VPN and firewall appliances, rather than researching individual organizations.

The two vulnerabilities named in the research are:

  • CVE-2025-64446 (Fortinet FortiWeb). NVD describes this as a relative path traversal flaw. It may let an attacker run administrative commands on the device by sending crafted HTTP or HTTPS requests. Affected versions are FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11. Fortinet scores it 9.8 (Critical) under CVSS v3.1. The NVD record was published November 14, 2025, and CISA's SSVC data in that record lists exploitation as "active."
  • CVE-2026-0257 (Palo Alto Networks PAN-OS / Prisma Access). NVD describes this as an authentication bypass in the GlobalProtect portal and gateway of PAN-OS that allows an unauthorized VPN connection. In plain terms, an outsider can join your VPN without valid credentials. Group-IB says it affects vulnerable PAN-OS configurations where authentication-override cookies and the relevant certificate configuration are enabled. Palo Alto's PSIRT scores it 7.8 (High) under CVSS v4.0. Panorama and Cloud NGFW are not affected. The record was published May 13, 2026.

Group-IB says brute-forcing was used as a fall-back against exposed Fortinet devices. Brute-forcing means trying large numbers of username and password combinations until one works. VPN portals and firewall admin interfaces that face the internet and are protected only by a password are exposed to this.

What happened after the break-in?

Group-IB says k0t did not stop at the edge device. To keep access, the operators used OpenConnect VPN (an open-source VPN client), remote monitoring and management (RMM) tools, and AdaptixC2, a command-and-control framework. RMM tools are the legitimate remote-administration software IT teams use every day. Attackers like them because the traffic and processes blend in with normal operations.

Group-IB also reports that the actor used well-known offensive tooling for moving through networks and stealing credentials, including NetExec, Impacket and Mimikatz. For data theft, in the few victims it compromised deeply, the actor used Rclone, a file-sync utility, to send data to Wasabi S3 cloud storage and to MEGA.

The researchers counted more than 70,000 exposed credentials, associated with network devices and LDAP dumps. LDAP is the directory protocol behind Active Directory and similar systems, so an LDAP dump can contain account details for a large part of an organization. Group-IB says these credentials were not linked to any other threat actors, including the previously reported FortiBleed cluster.

Is this connected to Qilin and The Gentlemen?

Possibly. Group-IB found that many k0t victims overlap with organizations later listed on the leak sites of two ransomware operations, Qilin and The Gentlemen. A leak site is where an extortion gang names victims and threatens to publish stolen data. Any listing there is the gang's own claim. Unless the named organization has confirmed it, that claim is unverified, and ZeroDayFeed has not independently confirmed any of the listings.

The researchers are careful about what the overlap proves. Group-IB says the shared victims suggest a possible relationship with ransomware operators or an initial access broker role, but the relationship is unconfirmed. An initial access broker breaks into networks and sells that foothold to other criminals, often ransomware affiliates, who then carry out the encryption and extortion. If that is k0t's role, the edge-device compromise and the ransomware attack could happen weeks or months apart and be carried out by different people.

Is this the same as FortiBleed?

Group-IB does not give a clean answer. FortiBleed is an earlier cluster of Fortinet-focused credential and access activity reported in June 2026. Group-IB's summary says the investigation found indications the k0t campaign may be connected to it, and notes that many FortiGate compromises fall in the same February to June 2026 window. At the same time, Group-IB says the k0t credential set was not linked to the FortiBleed cluster, and both Group-IB and The Hacker News report a negligible overlap in compromised data. Group-IB's reading is that this may be a separate dataset, an operator subset, or a related access operation within the broader FortiBleed-related activity. Defenders who have already dealt with FortiBleed should not assume they have covered k0t: the credentials and the methods differ, so review for it separately.

What It Means for Defenders

Who is affected: Any organization running internet-facing Fortinet FortiGate, Fortinet FortiWeb, or Palo Alto Networks GlobalProtect (PAN-OS or Prisma Access). The victim spread covers every region, so do not assume your location protects you. Small businesses and federal contractors that rely on a single VPN appliance for remote access should pay particular attention. For organizations working toward CMMC, a compromised boundary device is a direct hit to the access-control and boundary-protection practices that assessors look at.

Patch the named CVEs.

  • FortiWeb (CVE-2025-64446): If you run any of the affected versions listed above (8.0.0–8.0.1, 7.6.0–7.6.4, 7.4.0–7.4.9, 7.2.0–7.2.11, 7.0.0–7.0.11), upgrade to a fixed release according to Fortinet's advisory. CISA data marks this flaw as actively exploited, so treat it as an emergency fix. Patching after the fact does not undo a compromise that already happened.
  • GlobalProtect (CVE-2026-0257): Apply Palo Alto Networks' fixes for PAN-OS and Prisma Access according to its advisory. Panorama and Cloud NGFW are not affected. The flaw has been public since May 2026, so any appliance that went unpatched over the summer should be investigated, not just updated.

Assume credentials are burned. The 70,000-plus exposed credentials were associated with network devices and LDAP dumps. If you run one of the affected products, rotate local admin accounts on the appliance, VPN user passwords, and any service or directory accounts the device authenticates against. Require multi-factor authentication on VPN and admin logins, because without it brute-forcing is cheap.

Get admin interfaces off the internet. Firewall and web application firewall management portals should be reachable only from trusted management networks. Add lockout or rate limiting on VPN portals to slow down password-guessing.

Hunt for the post-exploitation signs the researchers describe. Specifically, look for:

  • Unexpected OpenConnect VPN sessions, or VPN connections from unfamiliar clients or locations.
  • RMM tools your IT team did not install, or RMM installs that do not match your approved list.
  • Signs of AdaptixC2, or of NetExec, Impacket or Mimikatz activity, on internal hosts.
  • Rclone running anywhere, and outbound traffic to Wasabi S3 or MEGA from servers that have no business reason to talk to them.

Look back far enough. Many of the FortiGate intrusions date from February to June 2026, and the actor has been active since October 2025. Review edge-device logs and authentication records over that full period if you still have them. If your logs do not go back that far, that is a finding in its own right.

Watch for the follow-up report. Group-IB says a more detailed technical report is coming. It may include indicators of compromise that make the hunt more precise.

The broader lesson is familiar but still matters. Edge appliances run with high privileges, are always reachable from the internet, and are often not watched as closely as endpoints. If k0t really is selling access, a firewall break-in that seems quiet today could lead to a ransomware attack later.

Sources