Campaign targeting edge firewalls exposes 70,000 credentials
Group-IB and NyxLab have disclosed a large-scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The activity has been linked to more than 70,000 exposed credentials associated with network devices and LDAP dumps, while investigators observed persistent remote access and data exfiltration at some affected organisations.
The researchers attribute the campaign to an actor known as k0t, also tracked as CryptoFeel, Member19 and QazWsxShop. First observed on October 22, 2025, the actor is assessed to have connections to the Qilin and The Gentlemen ransomware groups, potentially as an initial-access broker or affiliate. The exact nature of those connections remains unclear.
Internet-facing appliances were the entry point
The campaign did not appear to focus on a particular industry. Group-IB and NyxLab said k0t enumerated exposed VPN and firewall appliances at scale, making the product and location of a device more important than the sector of the organisation operating it.
Operators used public scanning services FOFA and ZoomEye to identify internet-facing appliances, filter targets by product and assemble lists of potentially vulnerable systems. They then attempted exploitation with bespoke Python scripts, including fortnew.py and exploit_2026_0257.py, or used common username and password combinations in brute-force attempts.
The reported flaws include CVE-2025-64446, a path traversal issue in FortiWeb, and CVE-2026-0257, an authentication bypass issue in Palo Alto Networks PAN-OS and Prisma Access. A significant share of compromises occurred between February and June 2026, overlapping with the credential-harvesting activity known as FortiBleed.
Access was expanded with familiar administration tools
After obtaining initial access, the attackers established an OpenConnect VPN connection and performed post-exploitation reconnaissance. This included enumeration of Active Directory, SMB and installed antivirus products, followed by additional credential theft and efforts to move deeper into corporate environments.
Investigators observed legitimate remote-access products used for persistence, including MeshCentral Agent, Atera, Teramind and AnyDesk, alongside the open-source adversary-emulation framework AdaptixC2. NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz were also used in the activity.
Harvested material was exfiltrated with Rclone to Wasabi S3 buckets and MEGA cloud drives. Group-IB and NyxLab found negligible overlap between the compromised data in this operation and FortiBleed, noting that the dataset could represent a separate operation, an operator subset or related access activity within the wider FortiBleed-related cluster.
Regional spread and operational response
Nearly 38% of victims were in Asia Pacific, followed by Latin America at 31.9%, Europe at 15.8%, and the Middle East and North Africa at 12.7%. The researchers said k0t's stated geographic priorities began with the United States and Canada, then European countries and selected APAC markets.
For businesses, the immediate implication is to remediate the cited vulnerabilities, reduce unnecessary exposure of VPN and firewall interfaces, rotate credentials that may be affected, and examine remote-access and outbound-transfer activity for signs of persistence or exfiltration.