k0t edge device campaign exposed 70,000+ credentials via Fortinet and Palo Alto flaws

Researchers at Group-IB and NyxLab have disclosed a year-long campaign by a cybercriminal actor tracked as k0t, also known as CryptoFeel, Member19 and QazWsxShop, that targeted internet-facing Fortinet and Palo Alto Networks edge appliances and left more than 70,000 credentials exposed. The haul includes network device logins and LDAP directory dumps, according to a write-up published by RedEye Threat Intelligence and syndicated on dev.to. The actor was first observed on October 22, 2025, and most compromises occurred between February and June 2026. Many of the victim organizations later appeared on the leak sites of the Qilin and The Gentlemen ransomware operations.

How the intrusions unfold

According to the researchers, k0t picks targets by product and location rather than industry, enumerating exposed appliances at scale with the internet-wide search engines FOFA and ZoomEye. Custom Python scripts — identified in the report as fortnew.py and exploit_2026_0257.py — exploit CVE-2025-64446, described as a path traversal flaw in Fortinet FortiWeb, and CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS and Prisma Access. When exploitation fails, the actor falls back to brute-forcing common username and password pairs. (The write-up's headline names FortiGate, while the CVE it cites is described in the report body as a FortiWeb flaw; the guidance covers FortiGate, FortiWeb, PAN-OS GlobalProtect and Prisma Access alike.)

After breaking in, k0t connects through an OpenConnect VPN session, so subsequent traffic arrives from an address the network already treats as a trusted remote user. From there the actor enumerates Active Directory, SMB shares and installed antivirus products, harvests further credentials, and secures persistence using legitimate remote management tools — MeshCentral Agent, Atera, Teramind and AnyDesk — plus the open-source AdaptixC2 adversary emulation framework. Stolen data is moved out with Rclone to Wasabi S3 buckets and MEGA cloud drives.

Lateral movement and privilege escalation rely on publicly available admin and pentest utilities, including NetExec, SoftPerfect Network Scanner, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz. None of the post-exploitation kit is custom malware, which the researchers say weakens signature-based detection.

Scale and geography

Victim distribution tracks exposure density rather than the actor's stated preferences: nearly 38 percent of victims sit in Asia Pacific, 31.9 percent in Latin America, 15.8 percent in Europe and 12.7 percent in the Middle East and North Africa. On dark web forums, k0t has sought exploit code, offensive tooling and premium FOFA and ZoomEye accounts, and lists the United States and Canada as top priorities — yet the actual victim spread suggests the campaign simply works through whatever the scanners find exploitable, with regions that patch edge hardware more slowly absorbing more of the activity.

The LDAP dumps are the more damaging component of the haul. Directory data hands an attacker the user population, group memberships and service accounts needed to plan privilege escalation, and any credential reused across systems can turn one edge compromise into domain-wide access.

FortiBleed overlap

The February–June 2026 peak coincides with FortiBleed, a separate credential harvesting campaign against Fortinet devices, but Group-IB and NyxLab found little overlap between the two compromised datasets. The relationship remains unclear: k0t's haul may be an independent dataset, a subset of the operators involved, or a related access operation inside the broader cluster. The practical takeaway is that remediation work done after FortiBleed should not be assumed to cover this campaign.

What operators should do

Both exploited vulnerabilities have vendor fixes, though the report does not name specific patched builds; affected versions are listed in the Fortinet PSIRT and Palo Alto Networks advisories. Patching closes the exploit path but does nothing about credentials already stolen or persistence already installed, and the brute-force route means even fully patched devices with weak or default passwords and no MFA remain exposed.

Group-IB and NyxLab advise organizations to patch both CVEs, treat any internet-facing appliance that was unpatched during the February–June 2026 window as potentially compromised, rotate credentials on the device and connected directory accounts, hunt for unauthorized RMM agents and AdaptixC2 artifacts, and enforce MFA on VPN access.

Why it matters

The campaign is a working model of the current edge device economy: commodity scanning, purchased exploits and off-the-shelf tooling, with access passed on to ransomware crews. The report links k0t to Qilin and The Gentlemen through victim overlap on leak sites, though the researchers say the exact relationship is unresolved. Because the VPN foothold looks like legitimate remote access, detection has to focus on behavior after login — Kerberos enumeration, PetitPotam coercion, newly installed RMM agents and large Rclone transfers to Wasabi or MEGA. For any organization running exposed firewalls or VPN gateways, an unpatched build or a guessable password is not a backlog item; it is a ransomware entry point.