k0t Firewall Credential Theft Campaign Explained: 70,000 Credentials Stolen From FortiGate and Palo Alto Devices (World Tech)

Illustrative image: network server racks in a data centre. No product photo exists for a threat campaign, so this is not a picture of the affected firewall devices. Image: Pexels / Brett Sayles (free licence)

TL;DR: k0t firewall credential theft campaign explained: researchers Group-IB and NyxLab have exposed a large-scale campaign by a threat actor called k0t that harvested more than 70,000 credentials from exposed Fortinet FortiGate, FortiWeb and Palo Alto GlobalProtect devices — then used them for persistent access and data theft. Patch, rotate credentials and take management interfaces off the internet.

📌 KEY HIGHLIGHTS

• 70,000+ credentials harvested: network-device logins and LDAP directory data tied to exposed firewall and VPN appliances worldwide.
• Targets: Fortinet FortiGate and FortiWeb plus Palo Alto Networks GlobalProtect — the boxes that guard the network edge.
• How they got in: known flaws (FortiWeb CVE-2025-64446, Palo Alto CVE-2026-0257) plus brute-forced weak passwords, found by scanning the internet at scale.
• What happened next: persistent remote access via legitimate admin tools, and data stolen to cloud storage — with possible links to ransomware groups, unconfirmed.
• Asia Pacific hit hardest: nearly 38% of identifiable victims are in APAC — the largest regional share in the investigation.

What happened?

Cybersecurity researchers have disclosed details of a large-scale campaign targeting the devices companies trust most: the firewalls and VPN gateways sitting at the edge of their networks. In a joint investigation published on 21 October 2026, Group-IB and NyxLab attributed the activity to a threat actor known as k0t — also tracked under the aliases CryptoFeel, Member19 and QazWsxShop — first seen in the wild on 22 October 2025.

The campaign is indiscriminate by design. Rather than researching individual companies, k0t's operators enumerate internet-facing VPN and firewall appliances in bulk using public scanning tools such as FOFA and ZoomEye, filter the results by product and location, and work through the list. A significant chunk of the compromises took place between February and June 2026. The researchers stress an important caveat: 70,000 exposed credentials does not mean 70,000 compromised organisations, and not every listed credential was valid — but the dataset proves the harvesting happened at industrial scale.

k0t firewall credential theft campaign explained: how the attacks worked

The attack chain, as documented by Group-IB and NyxLab and reported by The Hacker News, runs in six stages — and every stage uses either a known flaw or a legitimate tool, which is exactly why it is hard to spot:

Stage	What the attackers did
1. Reconnaissance	Scanned the internet with FOFA and ZoomEye to build target lists of exposed FortiGate, FortiWeb and GlobalProtect devices
2. Initial access	Exploited known flaws — FortiWeb path traversal CVE-2025-64446 and Palo Alto auth bypass CVE-2026-0257 — via custom Python scripts, or brute-forced common passwords
3. Foothold	Established access through an OpenConnect VPN connection
4. Credential theft	Enumerated Active Directory, SMB shares and installed antivirus; harvested device credentials and LDAP dumps
5. Persistence	Stayed in via legitimate remote tools — MeshCentral, Atera, Teramind, AnyDesk — plus the AdaptixC2 framework
6. Exfiltration	Moved stolen data out with Rclone to Wasabi S3 buckets and MEGA cloud drives

Once inside, the operators moved deeper with administrator and penetration-testing utilities that defenders themselves use — NetExec, Impacket, Mimikatz, Kerbrute and PetitPotam among them. That is the campaign's signature problem: when attackers live off legitimate tools, their traffic looks like ordinary administration until the data leaves.

Illustrative image: network infrastructure of the kind this campaign targets — switches, patch panels and server hardware. Image: Wikimedia Commons / Penguin905 (own work, free licence)

Why it matters for World Tech readers

The geography should sober up any reader in Asia Pacific: nearly 38% of identifiable victim domains are in APAC, followed by 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa. The researchers caution that this may reflect where exposed devices are concentrated rather than deliberate targeting — k0t's stated geographic priorities begin with the United States and Canada, then Europe and selected APAC markets — but for Indian organisations running FortiGate or GlobalProtect appliances, the message is the same: if the management interface is internet-facing, assume it has been probed.

The ransomware question is where reporting must stay honest. Many k0t victims were later listed by the Qilin and The Gentlemen ransomware groups on their leak sites, which suggests k0t may operate as an initial access broker — selling the way in to others — or as a ransomware affiliate. Group-IB and NyxLab are explicit that the exact connection is unclear, and the overlap with the separate FortiBleed credential-harvesting cluster is described as "negligible". Treat the ransomware link as a plausible risk, not a confirmed fact. The same caution applies to this week's other edge-device stories on this blog — the CISA KEV Collabora and Arista flaws and the PHP session upload progress flaw — all of them reward the same discipline: patch known bugs before attackers automate them.

Should you care?

✅ Act this weekend if you run FortiGate, FortiWeb or GlobalProtect: patch CVE-2025-64446 and CVE-2026-0257, rotate every credential stored on or passing through those devices, and remove management access from internet-facing interfaces. 🔍 Then hunt: look for unexpected OpenConnect VPN sessions, unfamiliar remote-admin tools (MeshCentral, Atera, AnyDesk) and outbound transfers to Wasabi or MEGA. ⏳ Everyone else: this is the week to ask what your organisation's edge devices are — and who can reach their login pages.

FAQs

Who is k0t?
k0t is a threat actor first observed on 22 October 2025, also known as CryptoFeel, Member19 and QazWsxShop. Group-IB and NyxLab attribute this firewall-targeting credential-theft campaign to k0t, and assess the actor may work as an initial access broker or ransomware affiliate — though the ransomware connection is unconfirmed.

Which devices did the k0t campaign target?
Exposed Fortinet FortiGate firewalls, FortiWeb appliances and Palo Alto Networks GlobalProtect portals. The attackers found targets by scanning the internet at scale rather than picking specific companies, so any internet-facing unit of these types was in scope.

How did attackers break into the firewalls?
Through known vulnerabilities — FortiWeb path traversal CVE-2025-64446 and Palo Alto authentication bypass CVE-2026-0257 — using custom Python scripts, and through brute-force attacks on common username and password combinations. Patching both flaws and enforcing strong, unique credentials plus multi-factor authentication closes the two main doors.

What should administrators check right now?
Confirm the two CVEs are patched, rotate credentials held on the devices, restrict management interfaces to trusted networks only, and hunt for signs of persistence: unexpected VPN sessions, unfamiliar remote-admin tools and data transfers to cloud storage services such as Wasabi S3 or MEGA.

Takeaway: The firewall is supposed to be the wall — k0t's campaign is a reminder that an unpatched, internet-facing wall is a door. Patch the two flaws, rotate the credentials, and pull management access off the public internet.

Follow World Tech on TechByCountry for the next hourly update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• The Hacker News — Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials (23 October 2026)
• GBHackers — K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign (October 2026)
• Cyber Press — Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect, Exposing 70,000+ Credentials (October 2026)
• Cybersecurity News — Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords (October 2026)
• Group-IB and NyxLab joint investigation into the k0t campaign (21 October 2026), as reported by the sources above.