k0t Edge Device Campaign Exposes 70,000+ Credentials Through FortiGate and GlobalProtect Appliances

More than 70,000 credentials tied to enterprise firewalls, VPN gateways and LDAP directories have been exposed in a year-long campaign against internet-facing edge devices. Group-IB and NyxLab attribute the activity to a cybercriminal actor called k0t, also known as CryptoFeel, Member19 and QazWsxShop. The actor was first seen on October 22, 2025, and most compromises happened between February and June 2026. Many of the victims were later listed on the data leak sites of the Qilin and The Gentlemen ransomware groups.

Targeting is not tied to any sector. k0t picks targets by product and location, not by industry. According to the researchers, the actor enumerates exposed appliances at scale instead of researching individual organizations. If your perimeter runs the right firmware in the right country, you are on the list.

Who k0t Is

k0t appears to work as an initial access broker or ransomware affiliate. The link to Qilin and The Gentlemen comes from victim overlap: organizations breached in this campaign later showed up on those gangs' leak sites. The researchers state that the exact relationship is unclear. Either way, access obtained by k0t has ended in extortion.

On dark web forums, k0t has shown steady interest in buying exploit code, offensive tooling and premium accounts on FOFA and ZoomEye, two internet-wide metadata search engines. Those purchases fit the operating model: find exposed devices fast, buy or build an exploit, and work through the target list before defenders patch. k0t's stated geographic priorities start with the United States and Canada, then European countries and selected APAC markets.

The Attack Chain

The intrusion sequence documented by Group-IB and NyxLab runs in six stages:

• Reconnaissance: FOFA and ZoomEye queries enumerate internet-facing VPN and firewall appliances, filter them by product, and produce target lists of likely vulnerable devices.
• Initial access: custom Python scripts named fortnew.py and exploit_2026_0257.py exploit CVE-2025-64446, a path traversal flaw in Fortinet FortiWeb, and CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS and Prisma Access. Where exploits fail, the actor brute-forces common username and password combinations.
• Foothold: the actor connects into the victim network through an OpenConnect VPN session using the stolen or bypassed access.
• Discovery and credential theft: enumeration of Active Directory, SMB shares and installed antivirus products, followed by more credential harvesting.
• Persistence: legitimate remote management tools including MeshCentral Agent, Atera, Teramind and AnyDesk, plus the open-source adversary emulation framework AdaptixC2.
• Exfiltration: Rclone moves harvested data into Wasabi S3 buckets and MEGA cloud drives.

For lateral movement and privilege escalation, k0t relies on standard admin and pentest utilities: NetExec, SoftPerfect Network Scanner, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz. None of these is custom malware. Every tool in the post-exploitation kit is publicly available and often already allowed somewhere in enterprise environments, which makes signature-based detection weak.

Scale and Geography

Victim distribution follows exposure density, not the actor's stated priorities. Nearly 38% of victims are in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa. The gap between where k0t wants to hit (North America first) and where victims actually sit suggests the campaign takes whatever the scanners find exploitable. Regions with slower patch cycles on edge hardware absorb a larger share.

The 70,000-plus exposed credentials include network device logins and LDAP dumps. LDAP data is the more damaging part. A directory dump gives an attacker the user population, group memberships and service accounts needed to plan privilege escalation, and any credential reused across systems turns one edge compromise into domain-wide access.

Relationship to FortiBleed

The peak window from February to June 2026 overlaps with FortiBleed, a separate credential harvesting campaign against Fortinet devices. Group-IB and NyxLab found negligible overlap in compromised data between the two. The researchers note that many operators are likely involved in the FortiBleed activity cluster, and that k0t's haul may be a separate dataset, a subset of operators, or a related access operation inside the broader FortiBleed activity.

In practice, organizations that already reviewed their exposure after FortiBleed should not assume that work covers this campaign. The credential sets are largely distinct.

Vendor Fixes and Mitigation

Both exploited vulnerabilities are known and have vendor fixes. CVE-2025-64446 affects Fortinet FortiWeb, and CVE-2026-0257 affects Palo Alto Networks PAN-OS and Prisma Access. The source report does not list specific fixed builds. Affected versions and patched releases are published in the Fortinet PSIRT and Palo Alto Networks security advisories for each CVE. Group-IB and NyxLab advise organizations to make sure every vulnerability named in their report is remediated.

Patching only blocks the exploit path. It does nothing about credentials already stolen or persistence already installed. The brute-force path also means that fully patched devices with weak or default passwords and no MFA remain exposed. Any appliance that was internet-facing and unpatched during the February to June 2026 window should be treated as potentially compromised. That means credential rotation for the device and connected directory accounts, plus a review for unauthorized RMM agents and AdaptixC2 artifacts.

Bottom Line

k0t does not need to know who you are. It needs your firewall to answer on the internet with a vulnerable build or a guessable password. With a confirmed pipeline from access to Qilin and The Gentlemen leak site listings, an exposed edge appliance is a ransomware entry point, not just a patching backlog item. RedEye Security can assess your internet-facing edge footprint, check for indicators of this campaign, and confirm whether exposure during the 2026 window led to persistence inside your environment.