k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB, in a report published on 21 October with NyxLab, described a campaign attributed to an operator known as k0t against firewalls and VPN portals exposed on the internet.

The collected set exceeds 70,000 credentials, including network device access and LDAP directory extractions. Researchers note that the total does not confirm successful compromise for every record. The report counts 84 compromised devices across 28 active groups on a MeshCentral server and treats unique domains as the minimum number of affected organizations.

Initial access came through two vulnerabilities. In FortiWeb, CVE-2025-64446 directory traversal was used to create an administrator account. In Palo Alto GlobalProtect, CVE-2026-0257 enabled authentication bypass via a forged cookie. FortiGate devices, not vulnerable to the FortiWeb flaw, were attacked through brute force of common passwords.

With access to FortiGate, operators downloaded the configuration file and recovered stored secrets using the default FortiOS encryption key, tracked as CVE-2019-6693. To reach domain administrator level, the report describes the known noPac attack chain.

Persistence was maintained with MeshCentral, the AdaptixC2 framework, and legitimate remote administration tools including Atera, AnyDesk, and ngrok. Data extraction used Rclone for cloud storage.

Asia-Pacific accounts for 37.6% of unique domains in the dataset, the largest regional share, while Latin America also shows high participation. Most FortiGate compromises occurred between February and June 2026. Victims appear on the leak sites of Qilin and The Gentlemen, though Group-IB does not confirm direct affiliation and assesses the operators most likely function as initial-access brokers.