A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to further attacks and data breaches.
The activity has been linked to a threat actor known as k0t, also known as CryptoFeel, Member19 and QazWsxShop. This threat actor was first seen in October 2025 and investigators suspect they could be selling the initial access to other criminals or working with ransomware affiliates. They could also be connected to Qilin and The Gentlemen, however the exact relationship is yet to be confirmed.
Over 70,000 network appliance credentials and LDAP data dumps were uncovered. There were a large amount of intrusions between February and June 2026. This coincides with the FortiBleed credential theft operation. However, there was not much overlap between the data stolen from both operations, suggesting it could be separate datasets or different groups working together.
This has impacted a wide range of industries. Asia Pacific is the most affected region with around 38% of victims found. Latin America follows with 31.9%, Europe 15.8% and Middle East and North Africa 12.7%.
The threat actor seems to be targeting a large amount of exposed devices, rather than specific companies within a particular industry. The US and Canada were the most stated regions of interest to the threat actor, followed by Europe and certain regions of Asia Pacific.
The threat actor uses services such as FOFA and ZoomEye to search for internet exposed assets. Once devices have been identified for exploitation the threat actor will try to exploit any vulnerabilities, such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PA Palo Alto Networks PAN-OS & Prisma Access). Custom Python scripts and brute force attacks are also used.
Once inside the threat actor can use OpenConnect VPN to connect, Active Directory and SMB environments can be reviewed and security software can be identified. Remote access tools such as Atera, Teramind, MeshCentral Agent and AnyDesk are used to help maintain access.
The AdaptixC2 framework is also used.
Tools such as NetExec, Impacket, Kerbrute and Mimikatz are used throughout the campaign. Data is moved using Rclone to Wasabi S3 and MEGA cloud accounts.
Some victims were later found on ransomware leak sites run by Qilin and The Gentlemen, however this does not necessarily indicate a direct link.
Organisations should ensure they patch the impacted products, look for any unusual access and check for any stolen credentials, unauthorised remote access and data exfiltration.
Read the original article:
Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials