Exposed Firewalls and VPNs Put More Than 70,000 Credentials at Risk
Between February and June 2026, a campaign attributed to the threat actor k0t targeted exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices, according to an investigation by Group-IB and NyxLab. The researchers identified more than 70,000 exposed credentials linked to network devices and LDAP dumps, while some intrusions led to persistent remote access and data exfiltration.
The campaign was not focused on a named industry or a small set of organizations. The investigation describes indiscriminate targeting of internet-facing network appliances, with nearly 38% of victims in Asia Pacific, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa. Group-IB and NyxLab said the operator appeared to choose targets by scanning exposed appliances at scale, making the product and location of a device more important than the victim's sector.
The initial access process combined reconnaissance, exploitation, and password attacks. The operator used public scanning tools including FOFA and ZoomEye to identify internet-facing firewalls and VPN appliances, then attempted to exploit CVE-2025-64446 in FortiWeb and CVE-2026-0257 affecting Palo Alto Networks PAN-OS and Prisma Access. The investigation also describes brute-force attempts using common username and password combinations.
After gaining an initial foothold, the operators used an OpenConnect VPN connection and examined environments for Active Directory, SMB, and installed antivirus products. They also used legitimate remote-access tools and AdaptixC2 to maintain persistence, then moved stolen data through Rclone to Wasabi S3 buckets and MEGA cloud drives. Utilities including NetExec, Impacket, Kerbrute, PetitPotam, and Mimikatz were used for deeper activity inside corporate environments.
The reported links to ransomware groups require caution. The investigation says many victims were later listed on the leak sites of Qilin and The Gentlemen, but it also says the exact relationship is unclear. It found negligible overlap between the compromised data in this campaign and the FortiBleed activity cluster, leaving open whether the activity represents a separate dataset, an operator subset, or a related access operation. The explicit recommendation from the researchers is to remedy the vulnerabilities identified in the report.