Overview
Researchers at Group-IB and NyxLab disclosed a large-scale campaign against exposed network edge devices, including Fortinet FortiGate and FortiWeb and Palo Alto Networks GlobalProtect, PAN-OS and Prisma Access. The investigation found more than 70,000 exposed credentials tied to network devices and LDAP dumps.
The activity is attributed to a threat actor tracked as k0t (also CryptoFeel, Member19 and QazWsxShop), first seen on October 22, 2025. The actor is assessed to have connections to the Qilin and The Gentlemen ransomware groups, possibly as an initial access broker or affiliate; the exact relationship is unclear.
Scale
| Item | Detail |
|---|---|
| Timeframe | Many compromises between February and June 2026 |
| Asia Pacific | ~38% of victims |
| Latin America | ~31.9% |
| Europe | ~15.8% |
| Middle East and North Africa | ~12.7% |
Victims span many sectors, reflecting indiscriminate targeting of exposed devices. Some were kept for persistent access and data exfiltration.
Tactics
- Discovery: FOFA and ZoomEye searches for exposed VPN and firewall appliances
- Initial access: Custom scripts for CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS / Prisma Access authentication bypass), or brute-forcing common credentials
- Foothold: OpenConnect VPN connections
- Post-exploitation: Active Directory, SMB and antivirus enumeration; credential theft with NetExec, Impacket, Mimikatz and Kerbrute
- Persistence: MeshCentral Agent, Atera, Teramind, AnyDesk and the AdaptixC2 framework
- Exfiltration: Rclone to Wasabi S3 buckets and MEGA
The researchers found negligible data overlap with the separate FortiBleed campaign, though operator overlap is possible.
Recommended Actions
The report's main guidance is to remediate the named vulnerabilities. Reasonable steps that follow from the findings:
- Patch FortiWeb and PAN-OS / Prisma Access against the CVEs above.
- Remove management and VPN portals from direct internet exposure where possible.
- Reset reused or weak credentials on edge devices and service accounts, and enforce MFA on VPN access.
- Hunt for the remote access tools and AdaptixC2 listed above, and for unexpected rclone traffic to Wasabi or MEGA.