Security researchers have detailed a large-scale campaign targeting exposed network edge devices, including Fortinet and Palo Alto firewalls.
The activity, attributed to threat actor k0t, leverages vulnerabilities such as CVE-2025-64446 and CVE-2026-0257 to establish persistent remote access and conduct data exfiltration.
How attacks work
Behind the attacks is an attacker using the name k0t, along with the aliases CryptoFeel, Member19, and QazWsxShop, who first appeared in October 2025. According to the data, the attacks do not target specific companies, but rely on a mass search of the Internet to identify exposed devices, such as network protection systems from well-known manufacturers.
Attackers identify vulnerabilities using public search tools and then exploit known security issues or try mass password combinations to break into systems. Once they gain access, they install legitimate remote control tools to maintain control, search for additional passwords and cached files, which they then transfer to remote storage locations on the internet.
Who is affected?
The victims come from various regions of the world. Nearly 38% are located in the Asia-Pacific region, 31,9% in Latin America, 15,8% in Europe, and 12,7% in the Middle East and North Africa. A large portion of the breaches were recorded between February and June 2026.
READ ALSO
Personal information of 11 million Burger King customers in Japan leaked
Researchers believe the perpetrator is connected to known groups that lock corporate files and demand ransom, likely acting as a collaborator to gain initial access to systems. Several of the victims of this campaign later appeared on lists of data leak websites, although the exact connection remains unclear.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)