k0t Access Broker Stole 70,000 Credentials From VPN and Firewall Devices

Access broker k0t reportedly stole more than 70,000 credentials from internet-facing Fortinet and Palo Alto Networks appliances, and some of that access was reportedly sold to ransomware groups.

By USA 24 Editorial TeamOctober 27, 20265 min read

Dim data center at night with amber status lights glowing on rack-mounted network appliances and cables on a steel floor. — Illustration: USA 24

ShareX Facebook LinkedIn Reddit Email

Key takeaways

An access broker called k0t reportedly stole more than 70,000 credentials, including network device logins, VPN accounts and LDAP directory records, according to a Group-IB and NyxLab report published October 21, 2026.
The campaign exploits CVE-2025-64446 in FortiWeb and CVE-2026-0257 in Palo Alto PAN-OS and Prisma Access, or it brute-forces logins.
A default key tracked as CVE-2019-6693 let attackers decrypt stored secrets from a Fortinet configuration, exposing LDAP, Active Directory and admin credentials.
Researchers caution that the 70,000 figure does not prove every listed credential worked or that every listed organization was breached.
Ransomware links are disputed: one account says the access is sold to Qilin and Inc., while another reports no arrests or charges and unconfirmed ransomware ties.

An access broker known as k0t has stolen more than 70,000 credentials from internet-facing Fortinet and Palo Alto Networks appliances, according to a report that Group-IB and NyxLab published on October 21, 2026. Some of that access was reportedly sold to ransomware groups, and the k0t FortiGate credentials case reaches well beyond one vendor's product line.

USA 24 has not reviewed Group-IB's primary report. This story relies on secondary coverage, and it flags where those accounts disagree or stop short of proof.

What the researchers reported

The report ties a campaign to the k0t actor. Cybersecurity News describes the targets as FortiGate, FortiWeb and Palo Alto GlobalProtect systems. The operation scans for exposed devices, then gets in either by exploiting known flaws or by brute-forcing logins, according to BeInsure and Security Online.

The 70,000 figure covers network device credentials, VPN accounts and LDAP directory records. It does not prove that every listed credential worked or that every listed organization was breached. CYPRO reports that the researchers themselves draw this distinction. Exposed credentials and compromised organizations are different counts, and the number of actual victims is still unknown.

Sources also disagree on geography. One summary says the reported victims are spread across Asia Pacific, Latin America, Europe and the Middle East. Decryption Digest places the database's concentration in North America, Europe and Asia-Pacific. No named US victim has been confirmed in the material reviewed.

How the attackers get in

Two named flaws anchor the access chain. CVE-2025-64446 is a path traversal bug in FortiWeb, and CVE-2026-0257 is an authentication bypass affecting Palo Alto PAN-OS and Prisma Access, according to Safeguard. Brute-forced logins offer a second route. That means a patch closes one door but does not reset passwords that may already have been guessed.

On the GlobalProtect side, the actor forged GlobalProtect cookies as part of the access chain, per Security Online. Forged session cookies can look like ordinary authenticated traffic, which is one reason the campaign is hard to spot from the perimeter alone.

Apply the Fortinet fix for CVE-2025-64446 and the Palo Alto fix for CVE-2026-0257 without delay. The sources reviewed for this story did not include Fortinet or Palo Alto statements on the campaign, so check vendor advisories directly. Whether either flaw appears in CISA's Known Exploited Vulnerabilities catalog has not been verified for this article.

Why one configuration file can expose a whole network

The most consequential step is the configuration grab. After logging in to a Fortinet device, the tooling could download the configuration and decrypt stored secrets using a default key tracked as CVE-2019-6693, a hard-coded FortiOS key. That exposed LDAP, Active Directory and admin credentials, according to Security Online.

For a firewall or VPN, that is not a single-box problem. A device bound to a directory account hands an attacker a working route into that directory. Stolen configuration data can therefore open doors far beyond the appliance itself. One early analysis counted 84 devices in 28 active groups on a single control server, also according to Security Online.

What the attackers do once inside

Once in, the actor enumerated Active Directory and SMB shares, identified installed antivirus products and harvested more credentials, according to an analysis on Dev.to. Persistence came from legitimate remote management tools, and the actor connected through OpenConnect VPN sessions. Tools that administrators already expect to see make the intrusion harder to flag in routine monitoring.

Some victims reportedly suffered persistent access and data theft to Wasabi and MEGA storage. Those victims later appeared on the Qilin and The Gentlemen leak sites, per the same analysis. Data theft to commercial cloud storage is a common extortion pattern, and it gives attackers leverage even when a victim restores its own systems.

Are ransomware gangs already using this access?

Here the reporting splits. Decryption Digest says the stolen access is being sold directly to Qilin and Inc. Security Online says no arrests or charges have been reported and that ransomware ties remain unconfirmed. Readers should treat the direct sales link as reported, not proven.

The business model explains why the concern is serious even without that link. Initial access brokers collect access to corporate networks and resell it to ransomware operators. A compromised VPN or firewall can become the entry point for a later extortion attack, as Safeguard describes. USA 24 has also covered ransomware gangs exploiting a Palo Alto GlobalProtect VPN flaw that was patched in May, which shows how a delayed patch becomes an entry point.

Keep the k0t story separate from PHP2Shell. USA 24's CISA PHP2Shell coverage covers a different flaw with its own federal patch deadline. The two stories overlap in time and in the edge-device theme, which is why readers may conflate them.

Which US organizations face the most risk

Organizations running FortiGate, FortiWeb or GlobalProtect with internet exposure face the most direct risk. So does any organization whose VPN or directory service is bound to those devices. Edge devices are a recurring target because they face the internet and often sit outside endpoint protections, according to Mogaz Masr.

For US businesses and public agencies, the exposure is hard to measure from outside. The reporting does not describe a public lookup for individual credentials. The practical question for employees is whether their employer runs affected devices and whether it has reset the relevant VPN and directory logins.

Steps to take now

Apply Fortinet's fix for CVE-2025-64446 on FortiWeb and Palo Alto's fix for CVE-2026-0257 on PAN-OS and Prisma Access.
Rotate credentials on any internet-exposed edge appliance and on the directory services those appliances use.
Check whether any firewall or VPN is bound to an Active Directory or LDAP account. Rotate those bind accounts and local users, since the configuration may have been read.
Require multifactor authentication for all VPN access.
Move management interfaces off the public internet.
Hunt for persistence, including unexpected remote management tools, unfamiliar OpenConnect sessions and VPN logins from unknown locations.

Compare these steps against vendor advisories before making changes, since the sources reviewed here do not include vendor statements on the campaign.

What to watch next

Several open questions will decide how serious this becomes. The primary Group-IB report, once reviewed directly, should clarify the victim count and the basis for the ransomware sales claim. Watch whether Fortinet and Palo Alto publish statements, whether CISA adds either flaw to its Known Exploited Vulnerabilities catalog, and whether a named organization confirms it was affected. Each of those developments would move the story from a credential-exposure report toward a confirmed breach story, and each would show how far the stolen access has traveled.

Frequently asked questions

Are my FortiGate VPN credentials stolen?

The reporting does not publish a list of affected accounts or a public lookup tool. If your employer runs an affected FortiGate or GlobalProtect device, ask IT whether it has applied the relevant patches and whether VPN and directory credentials were reset since October 21, 2026.

Is the k0t campaign targeting FortiGate devices?

Reports say the operation scans for exposed FortiGate, FortiWeb and GlobalProtect systems and collects network device credentials, VPN accounts and LDAP records. The reports do not establish that every listed credential worked. Researchers say the 70,000 total does not prove every listed organization was breached.

Which flaws should administrators patch first?

The reports name CVE-2025-64446, a FortiWeb path traversal bug, and CVE-2026-0257, an authentication bypass affecting Palo Alto PAN-OS and Prisma Access. Administrators should also rotate credentials on exposed appliances and check whether any device is bound to an Active Directory or LDAP account.

Is k0t linked to ransomware attacks?

The links are disputed. One account says the stolen access is sold to Qilin and Inc., while another reports no arrests or charges and says ransomware ties remain unconfirmed. Some victims reportedly later appeared on the Qilin and The Gentlemen leak sites.

Sources

#Cybersecurity #Ransomware #Fortinet #VPN Security #Access Brokers

About this article. Reported and produced by the USA 24 newsroom using the sources cited above. Read our editorial policy. Spotted an error? Tell us and we will correct it.