FortiAppSec Cloud incident on November 5, 2026: We are continuing to work on a fix for this issue. Started 11:56 AM UTC, resolved ongoing (● 5m). Affected: WAF Scrubbing Region - Azure - Brazil South (Sao Paulo).

Introduction: Modern enterprise web applications and API infrastructures face an unprecedented volume of complex threat vectors, ranging from OWASP Top 10 exploits to sophisticated automated bot attacks. Fortinet’s NSE 5 Cloud Security curriculum, centered around FortiWeb deployment, addresses these critical vectors by pairing signature-based inspection with advanced behavioral Machine Learning (ML). Achieving mastery in FortiWeb ensures robust application delivery, granular traffic management, and resilient cloud infrastructure posture across hybrid environments.

Introduction: Modern web applications and cloud infrastructures face non-stop threats targeting the application layer and dynamic API endpoints. Securing these perimeter and cloud resources requires robust Web Application Firewall (WAF) integration capable of inspecting multi-mode traffic, mitigating OWASP Top 10 vulnerabilities, and incorporating AI-driven threat detection. Building expertise around enterprise solutions like FortiWeb provides cybersecurity engineers with the tools needed to maintain resiliency and strict compliance across hybrid environments.

Group-IB and NyxLab tracked k0t exploiting FortiGate, FortiWeb and GlobalProtect to steal 70,000+ credentials. Includes MITRE mapping and SPL/KQL queries.

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

A campaign dubbed k0t stole over seventy thousand credentials by breaking into FortiGate, FortiWeb and GlobalProtect edge devices worldwide.

View post on Reddit.

Group-IB and NyxLab expose threat actor k0t's large-scale campaign exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials, establish persistent access and exfiltrate data

Internet-facing firewalls and VPN systems are under attack in a campaign that aims to steal credentials and gain lasting access to corporate networks. The activity targets FortiGate and FortiWeb devices from Fortinet, as well as Palo Alto Networks GlobalProtect portals. Once inside, operators can collect passwords stored in device configurations and use them to move deeper into a victim’s network. The campaign is linked to an operator known as k0t. Group-IB and NyxLab say the activity affected organizations across different industries and regions. Their investigation identified more than 70,000 exposed credentials and related data, including network-device credentials and LDAP records. The researchers warn that this total does not confirm that every listed credential led to a successful compromise. Analysts from Group-IB, working with NyxLab, identified the campaign and described its methods in a report published on October 21, 2026. They said operators search for exposed network equipment in bulk, then try to break in by exploiting software flaws or guessing weak passwords. Their findings include stolen credentials, signs of persistent remote access and cases of data theft. Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems The operators use public search services to find internet-facing VPN portals and firewalls. They then check discovered systems for weaknesses and attempt to gain access. Group-IB says the activity is broad rather than focused on a single industry. The number of devices exposed online and their settings may help explain which organizations appear in the collected data. FortiWeb devices were targeted with CVE-2025-64446, a path traversal flaw that can let an unauthenticated attacker run administrative commands through crafted web requests. Group-IB observed a custom tool attempting to use the flaw to create a new administrator account. FortiGate devices are not vulnerable to this FortiWeb flaw; instead, operators tried common username and password combinations against exposed FortiGate systems. General attack chain observed by campaign operators (Source – Group-IB) Fortinet describes CVE-2025-64446 as an improper access control issue affecting FortiWeb. The FortiGate activity can have effects beyond the firewall itself. After gaining access, operators may download a device configuration file and recover credentials stored in it, including administrator and LDAP or Active Directory account details. Group-IB says the attackers used a known default encryption key to decrypt some stored secrets. Organizations should therefore treat a potentially exposed configuration as a possible password disclosure, not just as a device-management issue. The campaign also targets Palo Alto Networks GlobalProtect systems. Group-IB observed attempts to exploit CVE-2026-0257, an authentication bypass flaw in GlobalProtect portals and gateways under specific PAN-OS settings. The flaw can allow an unauthorized VPN connection. Palo Alto Networks’ advisory describes the same risk and advises administrators to follow its remediation guidance. Cybersecurity News has previously covered FortiWeb flaw exploitation and a FortiWeb exploit tool release . These reports provide background on the FortiWeb weakness; the current investigation adds evidence of operators using it as part of a wider campaign against network-edge devices. What happens after access After entering a network, operators may use legitimate administration and security tools to discover systems, seek additional credentials and expand access. Group-IB observed tools including NetExec, Impacket and Mimikatz, alongside remote-management software such as MeshCentral and Atera. Their use can be hard to spot when defenders review only one event at a time, since legitimate tools may also appear in normal IT work. Researchers found 28 active device groups with 84 compromised devices linked to a MeshCentral server during their review. They also saw signs of other remote-access tools and a command-and-control framework. In some cases, data was copied to cloud storage using Rclone. Group-IB said some victims later appeared on ransomware leak sites, but it has not confirmed that k0t is directly affiliated with the ransomware groups involved. k0t’s MeshCentral login page at mesh[.]buttruyen[.]com (Source – Group-IB) Organizations can read more about FortiGate configuration theft and GlobalProtect authentication bypass activity in earlier Cybersecurity News coverage. These related reports describe risks that matter after an edge device is compromised: stolen credentials may enable further access, even if the initial entry point is later patched. Security teams should check whether FortiGate, FortiWeb and GlobalProtect systems are exposed to the internet, confirm that they run fixed software, and restrict administrative access to trusted networks where possible. They should review logs for unexpected administrator accounts, configuration exports, unusual VPN sessions, repeated login failures and management access from unfamiliar locations. Palo Alto Networks’ advisory provides remediation instructions for CVE-2026-0257; Fortinet’s advisory covers CVE-2025-64446. If a device may have been accessed, teams should investigate connected accounts and systems, rotate credentials stored in or linked to the appliance, and review VPN and identity logs for suspicious follow-on activity. FortiGate administrators should also check whether private-data encryption is enabled with an organization-controlled key. A lack of matching indicators does not prove that a device or network is safe; defenders should correlate appliance, VPN, identity and endpoint records. Indicators of compromise (IoCs):- Type Indicator Domain mesh[.]buttruyen[.]com IP address 62[.]60[.]131[.]43 Domain meshcentral[.]girydsfsggvb[.]com IP address 62[.]60[.]135[.]64 URL hxxps://agent[.]afahimsa[.]top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&in URL hxxp://193[.]149[.]187[.]81:1287/1.exe IP address 64.94.85.14 IP address 168.100.11.99 URL hxxp://162[.]33[.]178[.]213:8888/clear-thinking_61.92.4_INSTALL.exe URL hxxps://sthyjk[.]com:8443/clear-thinking_61.92.4_INSTALL.exe IP address 162[.]33[.]179[.]249 IP address 193[.]24[.]123[.]162 IP address 193[.]149[.]176[.]50 Domain radesashar[.]com IP address 193[.]169[.]194[.]21 Hash type Hash MD5 5318f29ef434341d989d543b14fd2a48 SHA-1 6546801898d0b32f5050f49c5302f0366d630cc9 SHA-256 158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a MD5 20dc8f1b8a313336c14e03bcb71ff6c8 SHA-1 e2c96e603323d8fc7c08678b793d56554faa6914 SHA-256 1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d MD5 032473db4d66748eab524effe57a661d SHA-1 b686a811ad89671fbdb448d65f79488d2e562265 SHA-256 4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d MD5 13367fbba4344de87de418ab17de76f0 SHA-1 f05daaf66b200672d679a5ced8b67d4b48a4906e SHA-256 552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21 MD5 197f2621c80da7974c56d2ff1921e994 SHA-1 e47a2b7ca6a8c009962871dbb667d128ad6b6162 SHA-256 f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e MD5 6f5d18157425aa9697913ae1310f588f SHA-1 bfd864ec0e6bd912f932e4f3ed80687736ee16e8 SHA-256 39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e MD5 0dc1af7cfd336a7f075228defc730082 SHA-1 b39cf70a0194d32e00d7812c29ae1d6add77b823 SHA-256 808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords appeared first on Cyber Security News .

FortiGate、FortiWeb、Palo Alto GlobalProtectの各アプライアンスを標的に、認証情報の窃取、永続的なアクセスの確立、企業データの外部持ち出しを狙う大規模なキャンペーンが確認されました。 調査では、この活動を「k0t」として知られるオペレーターに関連づけています。ネットワーク機器のレ

ハッカーが、インターネットに公開されているFortinet製ファイアウォール「FortiGate」、FortiWebアプライアンス、Palo Alto Networks製「GlobalProtect」システムを狙い、パスワードを盗んで企業ネットワークへのアクセスを維持しています。NyxLabなどによる共同調査は、この

At a glance Actor Operator using the alias "k0t," with suspected collaborators; possible initial access broker Activity Mass scanning, exploitation, and brute-forcing of network edge devices; persistence and data theft Targets Organizations worldwide running FortiGate, FortiWeb, and Palo Alto GlobalProtect Scale 70,000+ exposed credentials; 84 devices in 28 active groups on one control server Status

Group-IB and NyxLab expose threat actor k0t's large-scale campaign exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials, establish persistent access and exfiltrate data

Fortinet has released security updates to address high-severity vulnerabilities in FortiWeb and FortiClient for Windows. These vulnerabilities could allow unauthenticated attackers to access appliance...

The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance.

FortinetがFortiWebとFortiManagerの認証関連脆弱性CVE-2026-26035、CVE-2026-70468を修正。FortiWebでは特定のRADIUS設定で未認証ログイン、FortiManagerではFortiGateになりすまされる恐れがあります。影響バージョン、条件、修正版と対策を解説します。

Fortinet has released security updates addressing multiple vulnerabilities in its FortiWeb web application firewall (WAF) software. One critical flaw allows attackers to log in with arbitrary credentials, bypassing authentication mechanisms. The article does not specify CVE IDs, affected versions, or exact release dates for the patches. The vulnerability impacts Fortinet FortiWeb deployments, enabling unauthorized access to sensitive systems. No additional technical details, such as exploitation methods or attack vectors, are provided. The updates aim to mitigate these security risks in the affected software.