A campaign attributed to a threat actor tracked as k0t has compromised or probed Fortinet FortiGate, Fortinet FortiWeb and Palo Alto Networks GlobalProtect devices at scale, producing a dump of more than 70,000 credentials and related records. Group-IB and NyxLab disclosed the activity on October 21, 2026. Secondary reporting describes k0t as a suspected initial access broker.

What Happened

According to the researchers’ findings as relayed by multiple outlets, the operators scanned the internet for exposed edge devices and then used two routes in:

  • Credential attacks against FortiGate, using common and reused passwords.
  • Exploitation of known flaws: CVE-2025-64446 in FortiWeb and CVE-2026-0257 in Palo Alto GlobalProtect. One report says a custom tool attempted to create rogue FortiWeb administrator accounts.

The exposed data reportedly includes network-device logins and LDAP directory data, which is the kind of material that lets an intruder pivot from the perimeter into Active Directory.

How Big Is It, Really

The 70,000 figure counts records, not confirmed breaches. Not every credential is necessarily valid, and not every listed organization was compromised. One source puts confirmed compromised devices at 84, spread across 28 active groups tied to a single MeshCentral remote-management server used by the operators. Treat the headline number as an exposure estimate and the 84 as the floor for confirmed intrusions.

Attribution Is Contested

  • One outlet says the stolen access is being sold to ransomware groups including Qilin and Inc. Other reports say a direct link between k0t and any ransomware crew is unconfirmed.
  • Researchers noted possible overlap with the FortiBleed cluster but found negligible credential overlap, which does not establish common operators.
  • No arrests or charges have been reported.

Impact

Edge VPN and web-application firewalls sit at the trust boundary, so a valid admin or VPN credential typically means internal network access without malware on a host. Stolen LDAP bind credentials widen that further. Organizations running internet-facing FortiGate, FortiWeb or GlobalProtect should assume that password-only or weakly protected accounts are at risk.

Mitigation

  1. Patch FortiWeb for CVE-2025-64446 and PAN-OS/GlobalProtect for CVE-2026-0257 per the vendor advisories.
  2. Rotate all local admin, VPN and LDAP service-account credentials on affected devices, and review the configuration for unknown administrator accounts.
  3. Enforce MFA on VPN and device administration; remove password-only access.
  4. Restrict management interfaces to dedicated management networks, not the public internet.
  5. Hunt for MeshCentral agents or other remote-management tooling you did not deploy, and for logins from unfamiliar infrastructure in firewall and directory logs.
  6. Check the Group-IB and NyxLab reports for indicators of compromise.

References

Note: details here come from secondary reporting; the primary reports could not be retrieved at publication time.