Threat actor k0t harvests 70,000 credentials from Fortinet and Palo Alto firewalls worldwide

Cybersecurity firms Group-IB and NyxLab disclosed on October 21, 2026, that a threat actor tracked as k0t has run a large-scale automated campaign against internet-facing network security appliances, collecting more than 70,000 credentials and directory data from organizations worldwide. The targeted products include Fortinet FortiGate firewalls, Fortinet FortiWeb web application firewalls, and Palo Alto Networks GlobalProtect VPN gateways.

The actor used public internet scanning services — FOFA, ZoomEye, and Censys — to build target lists of exposed appliances, then combined brute-force password attacks on FortiGate devices with exploitation of two known vulnerabilities: CVE-2025-64446, a path traversal flaw in FortiWeb, and CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect that Palo Alto Networks has independently confirmed is under active exploitation. Stolen data included device administrator credentials and LDAP (directory service) account dumps, which were transferred to cloud storage services. Researchers found evidence that access was maintained through persistent VPN and remote-management connections after the initial breach. Group-IB assesses that k0t likely operates as an initial access broker — meaning it sells entry points into compromised networks to other criminal groups — and researchers note possible links to ransomware operations, though direct ties to specific ransomware groups remain unconfirmed.

This campaign is separate from but overlaps with the previously reported FortiBleed credential exposure. Organizations running any of the three targeted products may want to confirm they are running current patched firmware, audit for unexpected VPN sessions or admin account changes, and verify that management interfaces are not reachable from the public internet. Reviewing firewall and directory service logs for signs of enumeration activity is also a reasonable step given the scale of the campaign.