Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
“Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration,” according to a joint investigation published by Group-IB and NyxLab.
The widespread exploitation activity has been attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop. The cybercriminal actor was first seen in the wild on October 22, 2025.
The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate. Analysis of the threat actor’s dark web activity reveals a keen interest in purchasing vulnerability exploit code and tools or premium accounts for metadata search engines like FOFA and ZoomEye.
The campaign’s victims are global and belong to a broad range of sectors, given the indiscriminate targeting of exposed network devices. A significant chunk of compromises are said to have taken place between February and June 2026, which also overlaps with another credential harvesting campaign codenamed FortiBleed.
Nearly 38% of victims are concentrated in the Asia Pacific region, followed by 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa.
The attack chain plays out as follows –
- Conduct reconnaissance through public scanning tools like FOFA and ZoomEye to enumerate internet-facing VPN and firewall appliances, filter candidates by product, and put together target lists of potentially vulnerable edge devices.
- Attempt to exploit these devices via known vulnerabilities like CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named “fortnew.py” and “exploit_2026_0257.py,” or perform brute-force attacks using common username and password combinations, to obtain initial access.
- Establish a foothold on the targets via an OpenConnect VPN connection.
- Conduct post-exploitation actions and additional credential theft like enumeration of Active Directory, SMB, and installed antivirus solution.
- Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2.
- Exfiltrate harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.
The attacks are also characterized by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims’ corporate environments.
“k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations,” Group-IB and NyxLab researchers said. “His stated geographic priorities begin with the United States and Canada, followed by European countries and selected APAC markets.”
“The product and location of an exposed device therefore appear to matter more than the industry of the organization operating it, consistent with the broad range of victims observed in this campaign.”
k0t’s links to Qilin and The Gentlemen stem from the fact that many victims of the campaign were also later listed by the ransomware groups on their data leak sites. However, the exact nature of the connection between the threat and these gangs is unclear.
What’s more, Group-IB and NyxLab said they found a “negligible overlap” in compromised data between this activity and FortBleed. More than 70,000 exposed credentials associated with network devices and LDAP dumps have been identified in connection with the campaign.
“This aligns with reports that many operators are likely to be involved in the FortiBleed activity cluster, suggesting that this may be a separate dataset, operator subset, or related access operation within the broader FortiBleed-related activity,” the researchers said. “Organisations are advised to act on ensuring that any vulnerabilities mentioned in this report are appropriately remedied.”
