Security teams woke up to a coordinated campaign that systematically targeted internet-facing firewalls and VPN appliances, resulting in the exposure of more than 70,000 credentials and LDAP dumps. Researchers from Group-IB and NyxLab attribute the activity to an operator tracked as k0t (also known as CryptoFeel, Member19, and QazWsxShop). The intrusions—detected largely between February and June 2026—rely less on high-value targeting and more on mass enumeration of exposed devices, leaving organizations across regions and industries at risk.
Background and the actor behind the campaign
k0t first appeared on researchers’ radars in October 2025 and is assessed to operate as an initial access broker or affiliate, with ties to ransomware groups such as Qilin and The Gentlemen. Analysis of dark‑web activity shows the actor purchases exploit code and premium reconnaissance access (FOFA, ZoomEye), suggesting a businesslike approach: scan widely, filter by product and location, and exploit what’s exposed.
How the attacks unfold
The campaign follows a repeatable chain:
- Broad reconnaissance using public internet-scanning services to find exposed VPN and firewall appliances, then filtering by vendor and product.
- Initial access via known vulnerabilities (notably CVE-2025-64446, a FortiWeb path traversal, and CVE-2026-0257, an authentication bypass in Palo Alto PAN-OS/Prisma Access), custom Python exploits (fortnew.py and exploit_2026_0257.py), or brute-force credential stuffing with common username/password pairs.
- Establishing a remote connection (OpenConnect) and enumerating internal systems—including Active Directory and SMB—to harvest credentials and identify security products in use.
- Persistence through legitimate remote management tools (MeshCentral Agent, Atera, Teramind, AnyDesk) and by deploying an adversary-emulation framework called AdaptixC2.
- Lateral movement and deeper compromise using admin and pentesting utilities such as NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz.
- Exfiltration of harvested data with Rclone to cloud storage services like Wasabi S3 and MEGA.
Scale, geography, and victims
This campaign is notable for breadth rather than selectivity. Over 70,000 device credentials and LDAP dumps were linked to the activity. Victims spanned the globe, with nearly 38% in the Asia‑Pacific region, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa. Researchers observed most compromises occur where devices are exposed, meaning product and device location matter more than the victim organization’s industry.
Overlap with FortiBleed and ransomware listings
The incident timeline overlaps with another credential-harvesting activity called FortiBleed, though Group-IB and NyxLab report negligible overlap in compromised datasets—suggesting multiple operators or related access operations within a broader activity cluster. Many organizations later appeared on the leak sites of ransomware groups Qilin and The Gentlemen, which points to possible resale or sharing of access, though the precise relationship remains unclear.
Why exposed edge devices remain a critical weak point
Edge devices like firewalls and VPN concentrators are attractive because they sit at the perimeter and often run management interfaces accessible from the internet. Legacy configurations, delayed patching, weak or reused credentials, and lack of monitoring for administrative access make these appliances a low-effort, high-reward target for actors who automate reconnaissance and exploitation at scale.
Detection and response recommendations
Organizations can take concrete steps to reduce exposure and detect similar campaigns early:
- Inventory and reduce internet-facing attack surface: identify which VPN and firewall appliances are reachable from the internet and whether their management interfaces must remain exposed.
- Patch prioritized vulnerabilities immediately: remediate CVE-2025-64446, CVE-2026-0257, and any other vendor advisories relevant to your appliances.
- Enforce strong authentication: eliminate default and weak credentials, enforce password complexity, rotate credentials regularly, and apply multi-factor authentication for administrative access.
- Restrict management access: limit management-plane access via VPN or jump hosts, and apply strict source IP allowlists where feasible.
- Monitor for post-exploitation indicators: watch for unexpected OpenConnect sessions, the use of legitimate remote management agents appearing on atypical hosts, and telemetry from tools like Mimikatz or Kerbrute.
- Harden directory services and segmentation: minimize credential reuse, apply least privilege, and segment administrative hosts to prevent lateral movement.
- Log, hunt, and respond: centralize logs for firewall and VPN appliances, run threat-hunting queries for signs of credential harvesting or data exfiltration, and prepare an incident response plan that includes credential resets and forensic capture.
- Protect exfiltration channels: monitor cloud storage uploads and unusual Rclone usage patterns; apply data loss prevention to sensitive exports.
What security teams should learn
This campaign underlines an uncomfortable truth: attackers increasingly favor scale and automation, exploiting common misconfigurations and known CVEs across widely used products. Even organizations not directly targeted can be collateral victims if edge devices are exposed. Remediation is straightforward in principle—patching, reducing exposure, and enforcing strong access controls—but it requires consistent operational discipline.
Conclusion
The k0t campaign is a reminder that the perimeter remains a focal point for attackers who combine automated discovery with readily available exploit tools and benign-looking remote admin utilities to achieve persistence and data theft. Organizations should treat internet-exposed network appliances as critical assets, prioritize remediation of vendor advisories, and assume that any exposed device could be an initial access vector. Vigilant asset management, prompt patching, and strong authentication can dramatically reduce the odds of becoming the next entry on a leak site.
Licensed under CC BY-ND 4.0 International
