A suspected access broker called k0t has been harvesting logins from the firewalls and VPN gateways that let employees reach corporate networks, and the haul is large. Group-IB and NyxLab disclosed the campaign on October 21, 2026, reporting more than 70,000 exposed credentials and related records tied to organizations in several sectors and regions. The operator goes after FortiGate firewalls, FortiWeb web application firewalls and Palo Alto Networks GlobalProtect VPN portals. Any US company that exposes those devices to the internet should treat the disclosure as a live risk, and the story was still spreading through security outlets on October 23.
Which FortiGate, FortiWeb and GlobalProtect devices are targeted
The operator scans the internet for exposed network edge systems and tests them at scale, according to Cypro's summary of the investigation. Edge systems sit between the internet and the internal network, which is why a single compromise there can be so valuable.
Any organization running an internet-exposed appliance from these families is in scope. The risk rises for companies that tie those devices to LDAP or Active Directory, because the stolen material can include directory data. Cyberpress and Decryption Digest both say the material can include device admin credentials, VPN accounts and LDAP directory dumps.
How k0t gets in and what it does after
According to Mallory, attackers tried to exploit CVE-2025-64446 in FortiWeb and CVE-2026-0257 in GlobalProtect. They also tried common username and password combinations against FortiGate devices.
Researchers say the operator found exposed systems through the internet scanning tools FOFA and ZoomEye, applied the two CVEs where devices were unpatched, and brute-forced FortiGate logins. Decryption Digest is the only outlet reporting that detail, so treat the scanner and brute-force account as reported rather than independently confirmed.
Once inside, the operator goes after stored secrets. Cyberpress reports that attackers used a known default encryption key to recover some of them, which could turn a firewall intrusion into access to internal services. For exfiltration, the operator uses Rclone, a widely used command-line tool for copying files to cloud storage, according to The Hacker News.
Why stolen FortiGate credentials and directory dumps matter
Edge-device logins are valuable because one password can open several doors. A firewall administrator account can change rules and reach management functions. A VPN account can put an outsider on the internal network. LDAP and Active Directory data can map users, groups and service accounts, and that map helps the next intruder pick targets.
The campaign's place in the wider crime chain is still unclear. SecurityOnline describes k0t as a suspected initial access broker, meaning a group that sells or hands off footholds to other attackers. Ransomware links are unconfirmed, and no arrests or charges have been reported. Decryption Digest says stolen access is being sold to the Qilin and Inc ransomware groups, but no other source verifies that claim.
The group also goes by the aliases CryptoFeel, Member19 and QazWsxShop, according to a SimplySecure Group reproduction of The Hacker News article. That same reproduction includes a line from the joint investigation: “operators in this campaign have obtained access to numerous organizations worldwide.” The original report was not available for this story, so readers should treat that line as a reproduced quotation.
How many devices and organizations are actually affected
The most concrete count comes from the investigation itself: 84 compromised devices across 28 active MeshCentral device groups, all tied to one control server. Mallory and Cyberpress both report that figure.
The 70,000 number needs careful reading. Researchers caution that it does not mean every credential was valid or that every listed organization was breached. Whether those logins still work, and how many organizations were actually compromised, is not established in the reports.
Context matters too. GBHackers says researchers linked some compromises to the FortiBleed cluster, which was reported in June, with many FortiGate compromises occurring between February and June 2026. The newly found credential dataset is not tied to FortiBleed or other tracked actors, according to the same report.
Counts for the wider FortiBleed campaign also conflict. One outlet cites 86,644 devices, while another describes 70,000 to 75,000 devices across as many as 194 countries. Neither figure has been checked against a primary source, so this story does not rely on either one.
CVE-2026-0257 and the GlobalProtect patch status
| Vulnerability | Affected product | What the reports say |
|---|---|---|
| CVE-2026-0257 | Palo Alto Networks PAN-OS GlobalProtect | Authentication bypass, patched in May; active exploitation confirmed by Palo Alto Networks |
| CVE-2025-64446 | Fortinet FortiWeb | Exploitation attempted in the k0t campaign; check the vendor advisory for fixed versions |
Palo Alto Networks separately confirmed active exploitation of CVE-2026-0257, according to Cyberpress. The flaw affects certain portal and gateway configurations where authentication override cookies are enabled and a specific certificate configuration exists.
Help Net Security reports that several ransomware groups have been exploiting the flaw since June, even though it was patched in May. A device that was exploited before the fix can still hold credentials the attacker already took, so patching alone does not close the exposure.
USA 24 has covered the ransomware side of this flaw in Ransomware Crews Use Palo Alto PAN-OS Flaw to Reach Domain Credentials. The k0t campaign is the credential-theft side of the same device family, and it adds FortiGate and FortiWeb to the list of devices that need attention.
How to rotate firewall admin credentials after k0t
Work through these steps in order. Patching comes first, because rotating passwords on a device that remains open to the same flaw buys little.
- Inventory every internet-facing FortiGate, FortiWeb and GlobalProtect device, including management interfaces and VPN portals.
- Compare each device's firmware and configuration against the vendor advisories for CVE-2026-0257 and CVE-2025-64446. On GlobalProtect, check whether authentication override cookies are enabled and whether the certificate configuration matches the affected setup.
- Rotate LDAP, Active Directory and administrator credentials on affected devices, as SecurityOnline recommends. Also rotate VPN accounts and any service accounts the devices use to bind to directory services.
- Review logs for unusual administrator logins, new SSH keys or MeshCentral agents, and large outbound transfers. The sources point toward hunting for persistence and exfiltration but do not offer a full checklist, so fold these checks into your standard detection process.
- Restrict management interfaces to an internal admin network or a dedicated management tunnel wherever the product allows it.
What to watch next, including the VinSolutions claim
Several questions will shape the next few weeks. Will a primary report from Group-IB or NyxLab confirm how many of the 70,000 records are valid? Will the conflicting FortiBleed device counts be reconciled? Do the ransomware links firm up? And which US sectors and companies show up among victims? The reports describe global, multi-sector targeting without naming US victims, so that last answer is still open.
A separate and unverified claim deserves attention. Class Action U reports on a VinSolutions data breach lawsuit, updated October 23, 2026. A threat actor calling itself ScarlettGroup claims it stole customer Social Security numbers and dealer credentials from VinSolutions, a Cox Automotive dealer CRM. VinSolutions has not confirmed a breach, and Ransomware.live lists vinsolutions.com as a victim. It is a US story to track, but it is not part of the k0t campaign.
The pattern is familiar. USA 24 recently reported that a Citrix NetScaler zero-day is still planting web shells on US VPN gateways, and edge devices keep appearing in breach reports for the same reason: they face the internet and hold the keys. Expect more detail on k0t's targets as vendors publish fuller advisories and researchers test which stolen logins still work.
