GROUP-IB and NyxLab have uncovered a widespread campaign linked to an operator known as “k0t” that targets FortiGate, FortiWeb and Palo Alto GlobalProtect deployments. Launched largely between February and June 2026, the operation uses bulk asset discovery via attack-surface search engines to identify exposed VPN and firewall devices, then attempts exploitation and brute-forcing to gain persistence.
The effort has yielded more than 70,000 exposed credentials and persistent access across multiple corporate networks, with one MeshCentral server showing 84 compromised devices spread across 28 active groups. The researchers note the activity aligns with an initial access broker profile, though connections to ransomware remain unconfirmed.
Technically, the campaign relies on a FortiGate-focused toolchain. Fortinet targets were initially attacked with a script named “FortiGate Security Scanner,” attempting CVE-2025-64446 (a FortiWeb path traversal flaw) to create a new administrator account. If that failed, brute-forcing ensued, followed by a 60-second lockout timer, suggesting substantial FortiGate know‑how.
Once inside, credentials and secrets were extracted by decrypting stored data with a default key associated with CVE-2019-6693, exposing LDAP, Active Directory and admin credentials. For GlobalProtect, the attackers forged authentication cookies using CVE-2026-0257, enabling VPN sessions via OpenConnect.
Organisations are urged to patch CVE-2025-64446 and CVE-2026-0257, encrypt stored secrets, remove internet-facing management interfaces, monitor new admin accounts and config exports, rotate critical credentials and hunt for remote access tools such as MeshAgent, AdaptixC2, Atera, AnyDesk and Rclone.