Organizations may have a serious security problem hiding at the very point where they believe their networks are protected: the firewall and remote-access gateway.
A joint investigation by Group-IB Threat Intelligence and NyxLab has uncovered a large-scale campaign associated with a threat actor known as “k0t.” The operators have targeted internet-facing Fortinet FortiGate and FortiWeb appliances, as well as Palo Alto Networks GlobalProtect systems, using a combination of vulnerability exploitation and password attacks to gain access to corporate networks.
The investigation identified more than 70,000 exposed credentials and related data, including network-device credentials and LDAP information. Researchers also documented attempts to maintain persistent access, steal additional credentials, move deeper into compromised environments and exfiltrate corporate data.
The findings suggest that this is not simply a campaign to collect passwords. The operators appear equipped to turn initial access into a longer-term foothold inside victim networks, potentially preparing compromised organizations for further exploitation or ransomware activity.
Group-IB and NyxLab have identified overlaps between observed victims and ransomware leak-site listings associated with Qilin and The Gentlemen. However, they have not confirmed a direct relationship between k0t and either ransomware group.
For defenders, the investigation reinforces an uncomfortable reality: a vulnerability or weak password on an internet-facing security appliance can become the starting point for a much wider corporate breach.
A Campaign Built Around Exposed Devices
Rather than carefully selecting individual companies, k0t appears to rely heavily on large-scale reconnaissance to identify potentially vulnerable systems.
According to the investigation, the operators used internet-facing asset search engines, including FOFA and ZoomEye, to identify VPN portals, firewalls and other network devices. Censys was also mentioned in the operators’ activity around sourcing target lists.
The approach is straightforward: find exposed appliances, identify vulnerable or poorly protected systems, attempt access and retain any foothold that proves useful.
Researchers observed interest in several products, including FortiGate, FortiWeb, Palo Alto GlobalProtect, OPNsense and Cisco ISE. Searches involving SonicWall SMA1000 management consoles were also observed, although the investigators said they had found no evidence of a successful SMA1000 compromise by k0t.
That distinction matters. Identifying a product during reconnaissance does not establish that its vulnerabilities were successfully exploited.
The campaign’s victimology also suggests that exposure, rather than a particular industry, may be driving target selection. Organizations across different sectors and regions appeared in the available data.
Asia-Pacific and Latin America accounted for the largest shares of identified unique domains. Group-IB and NyxLab cautioned that these figures do not prove deliberate regional targeting: they may reflect where exposed devices were discovered and recorded.
The investigation also noted that many FortiGate compromises occurred between February and June 2026, overlapping with the timeline of the previously reported FortiBleed activity.
However, researchers found negligible overlap between the credential data examined in the k0t investigation and the dataset associated with FortiBleed. The precise relationship between the activities remains unresolved.
How Attackers Get In
The investigation identified multiple routes into victim networks, with different techniques used against different products.
FortiWeb: exploiting a vulnerability to create administrator access
One of the key techniques involves CVE-2025-64446, a path traversal vulnerability affecting Fortinet FortiWeb.
The researchers found a custom tool described as the “FortiGate Security Scanner,” although its observed exploitation function targeted FortiWeb. According to the report, the script attempts to exploit the vulnerability to create a new local administrator account on a vulnerable appliance.
The tool then checks whether the newly created credentials work. If the exploit attempt fails, the operators can fall back to brute-force attempts against exposed Fortinet devices.
The report also describes how successful access could be followed by the downloading of appliance configuration files. These files may contain credentials associated with LDAP, Active Directory, administrators and local users.
The investigators observed the operators attempting to decrypt stored secrets offline using a known default FortiOS encryption key associated with CVE-2019-6693.
For organizations, this creates a second layer of risk: even after an appliance has been secured, credentials extracted from its configuration may remain usable unless they are rotated and affected sessions are invalidated.
FortiGate: password attacks against exposed management interfaces
The investigation found that the operators used brute-force techniques against FortiGate devices.
Brute-forcing involves repeatedly attempting logins using lists of usernames and passwords. Password spraying uses a smaller set of common passwords across multiple accounts or devices.
The observed tool included logic to respond to account lockouts and retry targets after a delay. This indicates that the campaign was designed to automate access attempts at scale.
Organizations should not assume that a firewall is protected simply because it has not been identified as vulnerable to a particular exploit. Weak administrator credentials, exposed management services and insufficient access restrictions can provide another route in.
Palo Alto GlobalProtect: exploiting vulnerable configurations
The investigation also identified attempts to exploit CVE-2026-0257, an authentication-bypass vulnerability affecting GlobalProtect portals and gateways under specific vulnerable PAN-OS configurations.
According to Group-IB and NyxLab, the technique involved authentication-override cookie forgery. The operators used a custom tool to identify vulnerable systems and attempt to establish VPN connections.
The report specifies that exploitation depends on the relevant authentication-override and certificate configuration conditions being present.
This is an important reminder that vulnerability exposure is not always determined by the product name alone. The installed software version, enabled features and configuration can all influence whether a system is susceptible.
Security teams should therefore validate their own configurations against the vendor’s official advisory rather than relying solely on generic asset inventories.
Getting In Is Only the Beginning
The most concerning findings emerge after initial access.
Once inside a network, the operators were observed using a range of legitimate administrative and penetration-testing tools to discover systems, extract credentials, enumerate network shares and attempt to obtain higher privileges.
The tools identified in the investigation include NetExec, Impacket, Kerbrute, Mimikatz and SoftPerfect. Researchers also documented activity involving PetitPotam and exploitation of the Windows privilege-escalation vulnerabilities CVE-2021-42278 and CVE-2021-42287.
These tools can serve legitimate security purposes. Their presence alone does not prove malicious activity. What matters is how, where and by whom they are used.
In this campaign, the reported activity included credential dumping, remote command execution, Active Directory discovery and attempts to escalate privileges toward domain-administrator control.
If successful, such activity can turn the compromise of a single network appliance into a broader identity and infrastructure incident.
An attacker who obtains privileged credentials may be able to reach file servers, workstations, business applications and other systems that were never directly exposed to the internet.
That is why organizations should investigate the full attack chain rather than treating an edge-device compromise as an isolated hardware or firmware issue.
Legitimate Remote-Access Tools Become a Persistence Mechanism
Maintaining access is another central element of the campaign.
Group-IB and NyxLab observed the use of OpenConnect VPN connections, MeshCentral and MeshAgents, AdaptixC2, Atera, Teramind, AnyDesk and ngrok.
Several of these are legitimate remote-management or connectivity tools. They are widely used by IT departments and service providers, which can make unauthorized installations difficult to distinguish from normal administration without sufficient context.
MeshCentral
The researchers identified a MeshCentral server used to manage compromised devices. At the time of analysis, they observed 28 active device groups containing 84 compromised devices communicating with the server. Artifacts also indicated that another 100 device groups had been removed.
The reported configuration enabled automatic enrollment of agents, reducing the need for manual intervention when additional devices connected.
AdaptixC2
The operators also used AdaptixC2, a command-and-control framework that can provide remote shell access, file transfer, tunnelling and payload execution.
The investigation described it as an additional channel for maintaining control alongside MeshCentral.
For defenders, the implication is clear: monitoring only for traditional malware may not be enough. An attacker can use legitimate remote-management software or publicly available post-exploitation frameworks to maintain access without relying on a conspicuous, custom-built malware family.
Organizations need to know which remote-management tools are approved, who owns them, where their agents are permitted to run and which external servers they are allowed to contact.
Data Theft and Potential Ransomware Connections
The investigation found evidence that some compromised organizations had data exfiltrated using Rclone, a utility for transferring files to cloud storage.
Destinations identified in the report included Wasabi S3 buckets and MEGA cloud drives.
The researchers also observed that many victims had subsequently appeared on data leak sites associated with Qilin and The Gentlemen ransomware groups.
This raises the possibility that the operators are functioning as Initial Access Brokers (IABs). These actors obtain access to organizations and may then sell or share that access with other criminal groups.
However, this remains an assessment rather than a confirmed attribution. Group-IB and NyxLab have not established that k0t directly operates with either ransomware group, nor have they confirmed the precise commercial or operational relationship.
Even without a confirmed ransomware partnership, the risk is significant. Persistent access and stolen credentials can be valuable to other attackers, while exfiltrated information can create regulatory, contractual and reputational consequences.
Organizations should investigate signs of data movement alongside evidence of initial access. A successful patch does not automatically remove an attacker’s foothold or recover credentials that may already have been stolen.
Why This Matters for the Middle East and Africa
Although the investigation does not establish deliberate targeting of Middle Eastern or African organizations, its findings are relevant to enterprises and government institutions across both regions.
Financial institutions, telecommunications providers, energy companies, public-sector organizations and distributed businesses commonly rely on remote access to connect offices, administrators, contractors and third-party service providers.
An exposed firewall or VPN portal can become an entry point into environments containing sensitive business data, customer information and critical operational systems.
For organizations operating across multiple countries, the challenge can be compounded by inconsistent patching schedules, legacy appliances, outsourced IT administration and limited visibility across distributed networks.
The practical response should not be based on assumptions about regional targeting. It should begin with a straightforward question: which internet-facing network devices does the organization actually operate, and are they securely configured and fully patched?
Businesses should also review whether third-party administrators have excessive privileges, whether service-account credentials are protected and whether security teams can investigate activity across VPN, identity and endpoint systems.
For organizations seeking support with cybersecurity consulting, network security and vulnerability management, the investigation offers a timely reminder that perimeter protection and internal identity security must work together.
Ten Actions Security Teams Should Take Now
The following recommendations are based on the attack methods and defensive priorities described in the Group-IB and NyxLab investigation.
1. Inventory every internet-facing security appliance.
Identify FortiGate, FortiWeb, Palo Alto GlobalProtect and other externally accessible network devices. Include cloud-hosted appliances, remote offices, disaster-recovery environments and systems managed by third parties. Confirm that the inventory reflects actual exposure rather than intended configuration.
2. Patch vulnerable devices and verify vendor guidance.
Check all relevant appliances against official security advisories. Prioritize internet-facing systems affected by CVE-2025-64446 and CVE-2026-0257, applying the vendor-recommended fixes or mitigations for the specific product and configuration. Confirm remediation rather than assuming that a scheduled update succeeded.
3. Restrict management interfaces.
Where operationally possible, remove administrative interfaces from direct internet exposure. Limit management access to trusted networks, dedicated administrative workstations or approved access gateways. Review firewall rules and trusted-host settings for unnecessary exposure.
4. Eliminate weak and reused credentials.
Replace default and commonly used passwords with unique, strong credentials. Enforce appropriate account lockout and rate-limiting controls, and investigate repeated failed logins. Use phishing-resistant multifactor authentication where supported, particularly for privileged and remote-access accounts.
5. Protect appliance configuration secrets.
Review how network appliances store sensitive configuration data. For FortiGate systems, assess the vendor-documented private-data-encryption setting and the recommendations associated with CVE-2019-6693. If configuration files may have been accessed by an attacker, treat embedded credentials as potentially exposed and rotate them.
6. Audit administrator and service accounts.
Review local appliance accounts, LDAP bindings, Active Directory service accounts and other credentials accessible through network devices. Remove unauthorized accounts, reduce excessive privileges and rotate credentials that may have been compromised. Revoke sessions and tokens where appropriate.
7. Hunt for suspicious remote-management tools.
Review endpoint and network telemetry for unexpected MeshAgents, MeshCentral, AdaptixC2, Atera, AnyDesk, Teramind, ngrok and OpenConnect activity. Validate software ownership, installation history, execution context and external destinations before deciding whether activity is legitimate.
8. Monitor for lateral movement and privilege escalation.
Investigate unusual use of administrative utilities, credential-dumping activity, unexpected SMB connections, suspicious PowerShell execution and abnormal Active Directory queries. Correlate events across endpoints, identity systems, VPN logs and network appliances to identify activity that may appear benign in isolation.
9. Detect and investigate possible data exfiltration.
Monitor for unexpected Rclone execution and unusual transfers to cloud-storage services, including Wasabi S3 and MEGA. Review large or atypical outbound transfers, particularly when preceded by suspicious authentication, file discovery or credential access. Apply the investigation’s published indicators of compromise where appropriate, but do not treat the absence of a match as proof that a system is clean.
10. Prepare for incident response and improve staff readiness.
Preserve logs from appliances, VPNs, endpoints, identity providers, DNS and firewalls. Define procedures for isolating compromised devices, investigating downstream access, rotating exposed credentials and notifying relevant stakeholders. Use regular cybersecurity training and awareness to help IT teams and administrators recognize suspicious activity and respond consistently.
If compromise is suspected, organizations should engage their incident-response team or a qualified specialist. Remediation should address the original entry point, persistence mechanisms, stolen credentials and any downstream systems that may have been affected.
What Defenders Should Watch For
The indicators published by Group-IB and NyxLab can help security teams begin a targeted investigation. These include identified command-and-control infrastructure, suspicious domains, file hashes and the use of specific remote-management tools.
The investigation also describes a wider set of behaviours that may be useful for threat hunting:
- Unexpected administrator account creation or changes to trusted-host restrictions on network appliances.
- Repeated authentication failures followed by successful logins or unusual VPN sessions.
- Configuration exports or access to stored appliance secrets that cannot be explained by approved administration.
- Unusual use of credential-dumping tools or attempts to enumerate privileged Active Directory groups.
- Unauthorized remote-management agents or connections to unfamiliar external infrastructure.
- Suspicious Rclone activity and outbound transfers to cloud-storage services.
Security teams should obtain the complete technical indicators from the original Group-IB investigation and validate them before deploying blocking rules. Indicators can change quickly, and infrastructure associated with malicious activity may also be shared or reassigned.
Where possible, combine indicator-based searches with behaviour-based detection. This provides a stronger chance of identifying activity when attackers change domains, infrastructure or tools.
The Bigger Lesson: Security Appliances Need the Same Attention as Endpoints
Firewalls and VPN gateways are often treated as trusted infrastructure. They receive less direct attention from endpoint security tools, yet they can hold sensitive credentials and provide access to large portions of a corporate network.
The k0t investigation illustrates how an exposed appliance can become the first step in a much larger intrusion involving identity compromise, persistence, lateral movement and data theft.
It also demonstrates why patching alone is not always sufficient. If an attacker has already accessed an appliance configuration or created a persistent account, organizations must investigate what happened before the vulnerability was fixed.
A resilient defence combines timely patching, restricted administrative access, strong authentication, protected configuration secrets, continuous monitoring and a tested incident-response process.
For security leaders, the priority is to make sure internet-facing devices are known, properly maintained and monitored as part of the organization’s wider security architecture. Saintynet Cybersecurity provides a starting point for organizations exploring cybersecurity services, security improvement and professional training.
Conclusion
The campaign attributed to k0t shows how threat actors can exploit weaknesses in internet-facing security appliances to gain a foothold and then pursue broader access across corporate networks.
Group-IB and NyxLab identified more than 70,000 exposed credentials and related data, observed persistent access techniques and documented evidence of data exfiltration from some victims. Possible connections to Qilin and The Gentlemen remain unconfirmed.
Organizations should focus on the systems they expose, the credentials those systems can reveal and the activity that may follow an initial compromise. Review vendor advisories, patch vulnerable appliances, restrict administrative access, rotate potentially exposed secrets and investigate suspicious remote-management activity.
The firewall may be the front door to the network. If attackers get through it, the consequences can reach far beyond the perimeter.
Stay informed. Stay secure.
Primary source: Group-IB and NyxLab – “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”.
