Group-IB and NyxLab have linked more than 70,000 credentials, harvested from network edge devices and LDAP dumps, to a single campaign run by a threat actor they track as k0t (also CryptoFeel, Member19, and QazWsxShop). The targets are internet-facing Fortinet and Palo Alto appliances. The researchers describe how k0t picks them: he does not research organizations, he enumerates exposed appliances at scale through the scanning engines FOFA and ZoomEye, filters by product, and builds target lists from whatever responds.
That shows in the victim spread, which tracks exposure rather than sector. Nearly 38% sit in Asia Pacific, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa. k0t's stated priorities start with the United States and Canada, then Europe and selected APAC markets, but the compromises landed wherever the vulnerable boxes were. In the researchers' words, "the product and location of an exposed device therefore appear to matter more than the industry of the organization operating it."
The attack chain
The exploitation uses known vulnerabilities. Two are named in the report: CVE-2025-64446, a path traversal flaw in FortiWeb, and CVE-2026-0257, an authentication bypass in Palo Alto's PAN-OS and Prisma Access. To get initial access, k0t runs bespoke Python against them, scripts named fortnew.py and exploit_2026_0257.py, or brute-forces with common username and password pairs.
With initial access in hand, the foothold is an OpenConnect VPN connection into the environment. A VPN concentrator is built to carry exactly that kind of traffic, so the entry blends with normal use. From there the post-exploitation is conventional and Active Directory focused: enumeration of AD, SMB, and the installed antivirus, then the usual offensive toolbox of NetExec, Impacket, noPac, Kerbrute, PetitPotam, Mimikatz, and SoftPerfect. Persistence rides on legitimate remote access software: MeshCentral Agent, Atera, Teramind, and AnyDesk, alongside the open-source adversary-emulation framework AdaptixC2. Exfiltration runs through Rclone into Wasabi S3 buckets and MEGA cloud drives.
Who k0t works for
Group-IB and NyxLab assess k0t as an initial access broker or affiliate rather than the end of the chain. The evidence is overlap: many victims of this campaign later appeared on the data leak sites of the ransomware groups Qilin and The Gentlemen. The researchers do not claim a direct relationship beyond that, and call the exact nature of the connection unclear. k0t first surfaced on 22 October 2025, and his dark-web activity shows interest in buying exploit code and premium FOFA and ZoomEye accounts.
The campaign also sits next to FortiBleed, a separate credential-harvesting cluster. The two have "negligible overlap" in compromised data, which the researchers read as a separate dataset or operator subset within the broader FortiBleed activity. Most of the compromises here cluster between February and June 2026.
Where to look
The researchers' own advice is to remediate the vulnerabilities named in the report. Starting points that follow from the facts:
- Patch state on the two CVEs: FortiWeb for CVE-2025-64446, PAN-OS and Prisma Access for CVE-2026-0257.
- OpenConnect VPN sessions you did not provision. The foothold runs over an OpenConnect VPN connection, so a session you cannot account for is worth investigating.
- Remote access agents installed outside your approved inventory. MeshCentral, Atera, Teramind, or AnyDesk that IT did not deploy are persistence.
- Egress to Wasabi and MEGA endpoints, which is where Rclone sends the harvested data.
- Credential exposure. With 70,000-plus credentials and LDAP dumps in play, treat any account reachable from a compromised edge device as burned, and rotate device-local and LDAP-bound credentials rather than only the obvious admin accounts.
Top comments (0)