CYBERSECURITY researchers have detailed a large-scale campaign that targeted exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The joint investigation by Group-IB and NyxLab notes that operators in the campaign gained access to numerous organisations worldwide, with some victims subjected to further compromise, remote access, and data exfiltration.
The activity is attributed to a threat actor known as k0t (also CryptoFeel, Member19 and QazWsxShop), first seen on 22 October 2025, and the group is believed to act as an initial access broker or affiliate for ransomware outfits such as Qilin and The Gentlemen. Group-IB and NyxLab also found a strong interest in purchasing exploit code and tools on dark‑web marketplaces.
Victims span multiple sectors, with roughly 70,000 exposed credentials tied to network devices and LDAP dumps uncovered in connection with the operation.
The attack chain begins with public reconnaissance using FOFA and ZoomEye to enumerate internet-facing VPNs and firewall appliances, followed by attempts to exploit known flaws such as CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (authentication bypass in PAN-OS/Prisma Access), using bespoke scripts fortnew[.]py and exploit_2026_0257.py, or brute-force methods.
Footholds are established via OpenConnect VPN, then attackers perform post‑exploitation and credential theft, seek persistence with legitimate remote‑access tools, and exfiltrate data to Wasabi or MEGA storage. The report notes a broad, cross‑regional victim set, with Asia-Pacific and Latin America representing significant shares, and suggests that the exposed device’s product and location matter more than industry. Evidence from Group-IB and NyxLab indicates minimal overlap with the FortBleed cluster.