Identity
k0t access broker exposes 70,000 firewall and VPN logins
Group-IB and NyxLab tie a second edge device crew, k0t, to Qilin and The Gentlemen victims. How it gets in, the indicators, and what to rotate.
Group-IB and NyxLab published research on October 21 into a threat actor they track as k0t, which breaks into internet-facing Fortinet FortiGate, Fortinet FortiWeb and Palo Alto Networks GlobalProtect devices, steals the credentials stored on them and then works its way into Active Directory. The researchers have identified more than 70,000 exposed credentials tied to the group, drawn from network devices and LDAP directory dumps. Many organisations it breached were later listed on the leak sites of the Qilin and The Gentlemen ransomware operations.
This is a separate cluster from the FortiBleed campaign we covered on October 8, although it ran over the same months. Group-IB found negligible overlap between the two sets of stolen data and links the clusters only with moderate confidence. If you already reset passwords after FortiBleed, that does not cover k0t. You are in scope if you expose a FortiGate SSL VPN or admin page, a FortiWeb management interface, or a GlobalProtect portal to the internet.
How it works
k0t picks targets by device type. It uses FOFA and ZoomEye, search engines that index internet-facing services, to build lists of exposed VPN and firewall appliances, then runs a different entry method for each product.
On FortiGate it guesses passwords. Group-IB recovered a script, fortnew.py, that tries common usernames such as admin, fortinet, fgtsecure and sysadmin with passwords like admin, fortigate, F0rt!n3t123 and P@ssw0rd123. When FortiOS locks the account it pauses for 60 seconds and carries on, so the default lockout only slows it down.
On FortiWeb, a web application firewall, it exploits CVE-2025-64446 (CVSS 9.8), a path traversal flaw that Fortinet fixed in November 2025. The exploit sends a forged CGIINFO header that impersonates the built-in prof_admin profile and creates a local administrator. In k0t's version the new account has a random eight-character name, the same string as its password, and a trusted host of 0.0.0.0/0, meaning it can log in from anywhere.
On Palo Alto it uses CVE-2026-0257, the GlobalProtect forged-cookie bypass, through a script named exploit_2026_0257.py. We explained that flaw and its fixed builds in our October 22 post.
The step that turns one device into a directory breach is the configuration file. FortiOS stores secrets such as LDAP bind passwords, local user passwords and private key passphrases in an encrypted form, but by default it encrypts them with a key that is the same on every device. That is CVE-2019-6693. Fortinet's fix was an option, private-data-encryption, that replaces the shared key with one you set, and it is off by default. Group-IB says k0t downloads configurations and decrypts them offline to recover the LDAP and Active Directory bind account, admin credentials and local users. A bind account that can read the whole directory gives the attacker a valid domain login on day one.
What attackers are doing
Group-IB dates many of the FortiGate compromises between February and June 2026. Once on a device, the operators open an OpenConnect VPN session into the network and enumerate Active Directory, SMB shares and the installed antivirus. The tools are mostly public: NetExec, SoftPerfect Network Scanner, Impacket, Kerbrute, PetitPotam, Mimikatz and noPac, which chains CVE-2021-42278 and CVE-2021-42287 to turn a normal domain account into a domain admin.
For persistence they install remote management agents: MeshCentral, Atera, Teramind and AnyDesk, plus the AdaptixC2 command and control framework and ngrok tunnels. One MeshCentral server the researchers examined had 28 active device groups holding 84 compromised machines, split across three operator accounts, and about 100 other groups had already been removed. Data leaves through Rclone to Wasabi S3 buckets and MEGA drives.
Victims are spread across many industries. Asia Pacific accounts for the largest share of identified victim domains at 37.6 percent, with Latin America next, although k0t's own stated priorities put the US and Canada first. Group-IB assesses that several people run the operation, under handles including k0t, CryptoFeel and Scrooge, and that they most likely act as initial access brokers. The link to Qilin and The Gentlemen rests on victims later appearing on their leak sites and is not confirmed. The 70,000 figure counts exposed records, so it does not mean every credential still worked or led to a breach.
What to do
1. Patch the two entry flaws
Upgrade FortiWeb to 8.0.2, 7.6.5, 7.4.10, 7.2.12 or 7.0.12 or later. Qualys, AhnLab and UpGuard, citing Fortinet's advisory FG-IR-25-910, give 7.6.5 as the fixed 7.6 release, while one NSFOCUS notice says 7.6.6, so go to the newest 7.6 build you can. For GlobalProtect, use the fixed PAN-OS builds in our CVE-2026-0257 post.
2. If you cannot patch today
Take management interfaces off the internet. On FortiGate and FortiWeb, remove HTTPS, SSH and HTTP from set allowaccess on WAN interfaces and set trusted hosts on every admin account to your management range. Raise the FortiGate lockout with config system global, set admin-lockout-threshold and set admin-lockout-duration, and alert on repeated login failures from one source.
3. Check for compromise
- List admin accounts on FortiGate and FortiWeb. An eight-character random name, a
prof_adminprofile or a trusted host of0.0.0.0/0that nobody created is a strong sign of the FortiWeb exploit. - Search endpoints for MeshAgent, Atera, Teramind, AnyDesk, ngrok and the AdaptixC2 installer
clear-thinking_61.92.4_INSTALL.exe, and proxy logs for Rclone traffic to Wasabi or MEGA. - Search DNS, proxy and firewall logs for MeshCentral servers
mesh[.]buttruyen[.]com(62.60.131[.]43) andmeshcentral[.]girydsfsggvb[.]com(62.60.135[.]64), AdaptixC2 servers 64.94.85[.]14 and 168.100.11[.]99, andsthyjk[.]com,alknene[.]shopandradesashar[.]com. Group-IB's report lists the rest, along with file hashes. No match does not clear you.
4. Rotate and harden
Treat any configuration that may have left the device as a credential leak. Rotate every secret in it: the LDAP bind account, local VPN users, admin passwords, RADIUS secrets and IPsec pre-shared keys. Then run config system global, set private-data-encryption enable and set your own key, so the next stolen backup is not readable with the shared default key. Fortinet warns this can cause install errors on FortiGates managed by older FortiManager releases, so check your versions first. Give the bind account read-only rights to the groups the firewall needs, and require multi-factor authentication (MFA) on VPN and admin logins.
A firewall holds directory credentials
Teams patch firewalls as network kit but rarely list the passwords stored on them in their identity inventory. A FortiGate configuration can hold an Active Directory bind account, RADIUS secrets and VPN users in one file, protected by a key shared across all devices unless someone changed it. Add each edge device's stored service accounts to the same rotation and least-privilege review as any other domain service account.
Our safeguarding and hardening work reviews firewall and VPN configuration, including stored secrets and bind account rights, and our security operations team hunts for the remote management agents and logins described here. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Group-IB, The Hacker News, Fortinet FG-IR-19-007, NVD CVE-2019-6693, Qualys on CVE-2025-64446, AhnLab on CVE-2025-64446, UpGuard on CVE-2025-64446, Rapid7 on CVE-2025-64446.