Group-IB and NyxLab tracked k0t exploiting FortiGate, FortiWeb and GlobalProtect to steal 70,000+ credentials. Includes MITRE mapping and SPL/KQL queries.

YouTube video by Draw Tee & Drink Tea

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

📅 Source : infostealers.com (Hudson Rock), publié le 27 octobre 2026. Cet article présente les résultats de FortiBleed 2.0, une investigation de suivi menée par Hudson Rock avec le crédit de recherche attribué à NyxLab et à leur analyse de l'acteur k0t.

📅 Source : infostealers.com (Hudson Rock), publié le 27 octobre 2026. Cet article présente les résultats de FortiBleed 2.0, une investigation de suivi menée par Hudson Rock avec le crédit de recherche attribué à NyxLab et à leur analyse de l'acteur k0t.

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

A campaign dubbed k0t stole over seventy thousand credentials by breaking into FortiGate, FortiWeb and GlobalProtect edge devices worldwide.

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

k0tがネットワークデバイスの脆弱性を悪用し、persistent accessを確立。Rcloneを使用してデータを窃取。企業ネットワークに深刻なリスク。即座の検証と認証情報の変更が必須。

A large-scale campaign targeting Fortinet and Palo Alto Networks firewalls has been disclosed, with threat actor k0t linked to ransomware […]

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

A global cyberattack campaign linked to threat actor k0t has targeted Fortinet and Palo Alto Networks security appliances, stealing credentials and establishing persistent access to organizations worldwide.

Group-IB and NyxLab link a campaign targeting exposed Fortinet and Palo Alto network devices to actor k0t, reporting persistent access attempts and more than…

Group-IB and NyxLab expose threat actor k0t's large-scale campaign exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials, establish persistent access and exfiltrate data

At a glance Actor Operator using the alias "k0t," with suspected collaborators; possible initial access broker Activity Mass scanning, exploitation, and brute-forcing of network edge devices; persistence and data theft Targets Organizations worldwide running FortiGate, FortiWeb, and Palo Alto GlobalProtect Scale 70,000+ exposed credentials; 84 devices in 28 active groups on one control server Status

 A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to further attacks and data breaches.  The activity has been linked to a threat actor known as k0t, also known as CryptoFeel, Member19 and QazWsxShop. This threat actor was first seen in October 2025 and investigators suspect they could be selling the initial access to other criminals or working with ransomware affiliates. They could also be connected to Qilin and The Gentlemen, however the exact relationship is yet to be confirmed.  Over 70,000 network appliance credentials and LDAP data dumps were uncovered. There were a large amount of intrusions between February and June 2026. This coincides with the FortiBleed credential theft operation. However, there was not much overlap between the data stolen from both operations, suggesting it could be separate datasets or different groups working together. This has impacted a wide range of industries. Asia Pacific is the most affected region with around 38% of victims found. Latin America follows with 31.9%, Europe 15.8% and Middle East and North Africa 12.7%.  The threat actor seems to be targeting a large amount of exposed devices, rather than specific companies within a particular industry. The US and Canada were the most stated regions of interest to the threat actor, followed by Europe and certain regions of Asia Pacific. The threat actor uses services such as FOFA and ZoomEye to search for internet exposed assets. Once devices have been identified for exploitation the threat actor will try to exploit any vulnerabilities, such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PA Palo Alto Networks PAN-OS & Prisma Access). Custom Python scripts and brute force attacks are also used.  Once inside the threat actor can use OpenConnect VPN to connect, Active Directory and SMB environments can be reviewed and security software can be identified. Remote access tools such as Atera, Teramind, MeshCentral Agent and AnyDesk are used to help maintain access.  The AdaptixC2 framework is also used. Tools such as NetExec, Impacket, Kerbrute and Mimikatz are used throughout the campaign. Data is moved using Rclone to Wasabi S3 and MEGA cloud accounts. Some victims were later found on ransomware leak sites run by Qilin and The Gentlemen, however this does not necessarily indicate a direct link.  Organisations should ensure they patch the impacted products, look for any unusual access and check for any stolen credentials, unauthorised remote access and data exfiltration.

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

FortiGate、FortiWeb、Palo Alto GlobalProtectの各アプライアンスを標的に、認証情報の窃取、永続的なアクセスの確立、企業データの外部持ち出しを狙う大規模なキャンペーンが確認されました。 調査では、この活動を「k0t」として知られるオペレーターに関連づけています。ネットワーク機器のレ