Cybersecurity researchers have uncovered a large scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, resulting in unauthorized access attempts against organizations worldwide. A joint investigation by Group IB and NyxLab revealed that operators linked to the campaign gained access to multiple organizations and attempted further compromise activities, including maintaining remote access and extracting sensitive data. Researchers attributed the activity to a threat actor known as k0t, who is also associated with the aliases CryptoFeel, Member19 and QazWsxShop. The actor was first observed in the wild on October 22, 2025, and investigators believe the campaign may have connections with ransomware groups such as Qilin and The Gentlemen, potentially operating through initial access activities or affiliate relationships.
According to researchers, the campaign targeted internet exposed network appliances across multiple regions and industries rather than focusing on specific organizations. Analysis showed that a significant number of compromises occurred between February and June 2026, overlapping with another credential harvesting activity known as FortiBleed. The affected organizations were distributed globally, with approximately 38% of identified victims located in the Asia Pacific region, followed by 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa. Investigators said the attackers appeared to prioritize identifying vulnerable devices based on their location and technology type rather than the sector of the organization operating them. The campaign reportedly involved reconnaissance through public scanning platforms such as FOFA and ZoomEye to identify exposed VPN and firewall systems and create lists of potential targets.
The attack process involved exploiting known security weaknesses in network devices and using automated techniques to gain initial access. Researchers identified attempts involving vulnerabilities such as CVE 2025 64446, a path traversal issue affecting FortiWeb, and CVE 2026 0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN OS and Prisma Access. Attackers reportedly used custom Python scripts, including tools named fortnew.py and exploit_2026_0257.py, along with brute force attempts using common username and password combinations. After gaining access, operators established connections through OpenConnect VPN and performed additional activities such as Active Directory discovery, SMB enumeration and identification of installed antivirus solutions. To maintain access, attackers used legitimate remote management tools including MeshCentral Agent, Atera, Teramind and AnyDesk, along with AdaptixC2, an open source adversary emulation framework. Researchers also observed the use of administration and penetration testing utilities such as NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz to move deeper into affected environments.
The investigation found that attackers used Rclone to transfer stolen information into Wasabi S3 storage buckets and MEGA cloud drives, enabling data exfiltration from compromised systems. More than 70,000 exposed credentials linked to network devices and LDAP dumps have been identified as part of the campaign. Researchers noted that several victims were later listed on data leak websites operated by ransomware groups, which contributed to suspected links between the activity and groups such as Qilin and The Gentlemen. However, the exact relationship between the threat actor and these ransomware operations remains unclear. Group IB and NyxLab also reported limited overlap between the compromised data identified in this campaign and FortiBleed related activity, suggesting that the operations may involve separate datasets, different operators or connected access activities. Security researchers have advised organizations to address the identified vulnerabilities, secure exposed network devices, review access controls and strengthen monitoring practices to reduce risks associated with unauthorized access and credential compromise.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
