# k0t Hackers Harvest 70,000 Credentials From FortiGate and GlobalProtect

- URL: https://usa-24.com/fortigate-credentials-stolen-k0t-campaign/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-24T04:03:02.354Z
- Updated: 2026-10-24T04:03:02.362Z
- Topics: FortiGate, Palo Alto GlobalProtect, Credential Theft, Access Brokers, Edge Devices, K0t Campaign

> Group-IB and NyxLab tied a suspected access broker called k0t to exposed FortiGate, FortiWeb and GlobalProtect devices. Rotate LDAP and admin credentials now.

## Key takeaways

- Group-IB and NyxLab disclosed the k0t campaign on October 21, 2026, identifying more than 70,000 exposed credentials and related records.
- The operator targets Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect devices, and researchers counted 84 compromised devices across 28 MeshCentral device groups.
- CVE-2026-0257 in GlobalProtect was patched in May, yet several ransomware groups have been exploiting it since June, according to Help Net Security.
- The stolen material can include device admin credentials, VPN accounts and LDAP directory dumps, so administrators should rotate those logins on affected devices.
- Ransomware links to k0t remain unconfirmed, and no arrests or charges have been reported.

A suspected access broker called k0t has been harvesting logins from the firewalls and VPN gateways that let employees reach corporate networks, and the haul is large. Group-IB and NyxLab disclosed the campaign on October 21, 2026, reporting more than 70,000 exposed credentials and related records tied to organizations in several sectors and regions. The operator goes after FortiGate firewalls, FortiWeb web application firewalls and Palo Alto Networks GlobalProtect VPN portals. Any US company that exposes those devices to the internet should treat the disclosure as a live risk, and the story was still spreading through security outlets on October 23.

## Which FortiGate, FortiWeb and GlobalProtect devices are targeted

The operator scans the internet for exposed network edge systems and tests them at scale, according to [Cypro's summary of the investigation](https://cypro.co.uk/insights/cyber-bulletins/k0t-campaign-targets-fortigate-and-globalprotect/). Edge systems sit between the internet and the internal network, which is why a single compromise there can be so valuable.

Any organization running an internet-exposed appliance from these families is in scope. The risk rises for companies that tie those devices to LDAP or Active Directory, because the stolen material can include directory data. [Cyberpress](https://cyberpress.org/hackers-expose-70000-credentials/) and [Decryption Digest](https://www.decryptiondigest.com/blog/fortigate-globalprotect-credentials-exposed-k0t) both say the material can include device admin credentials, VPN accounts and LDAP directory dumps.

## How k0t gets in and what it does after

According to [Mallory](https://mallory.ai/stories/01a1627c-e4f5-7be3-8afe-73747fce13a1), attackers tried to exploit CVE-2025-64446 in FortiWeb and CVE-2026-0257 in GlobalProtect. They also tried common username and password combinations against FortiGate devices.

Researchers say the operator found exposed systems through the internet scanning tools FOFA and ZoomEye, applied the two CVEs where devices were unpatched, and brute-forced FortiGate logins. Decryption Digest is the only outlet reporting that detail, so treat the scanner and brute-force account as reported rather than independently confirmed.

Once inside, the operator goes after stored secrets. Cyberpress reports that attackers used a known default encryption key to recover some of them, which could turn a firewall intrusion into access to internal services. For exfiltration, the operator uses Rclone, a widely used command-line tool for copying files to cloud storage, according to [The Hacker News](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html).

## Why stolen FortiGate credentials and directory dumps matter

Edge-device logins are valuable because one password can open several doors. A firewall administrator account can change rules and reach management functions. A VPN account can put an outsider on the internal network. LDAP and Active Directory data can map users, groups and service accounts, and that map helps the next intruder pick targets.

The campaign's place in the wider crime chain is still unclear. [SecurityOnline](https://securityonline.info/k0t-fortigate-globalprotect-attacks/) describes k0t as a suspected initial access broker, meaning a group that sells or hands off footholds to other attackers. Ransomware links are unconfirmed, and no arrests or charges have been reported. Decryption Digest says stolen access is being sold to the Qilin and Inc ransomware groups, but no other source verifies that claim.

The group also goes by the aliases CryptoFeel, Member19 and QazWsxShop, according to a [SimplySecure Group reproduction of The Hacker News article](https://simplysecuregroup.com/hackers-breach-enterprise-firewalls-and-vpns-exposing-over-70000-credentials/). That same reproduction includes a line from the joint investigation: “operators in this campaign have obtained access to numerous organizations worldwide.” The original report was not available for this story, so readers should treat that line as a reproduced quotation.

## How many devices and organizations are actually affected

The most concrete count comes from the investigation itself: 84 compromised devices across 28 active MeshCentral device groups, all tied to one control server. [Mallory](https://mallory.ai/stories/01a1627c-e4f5-7be3-8afe-73747fce13a1) and Cyberpress both report that figure.

The 70,000 number needs careful reading. Researchers caution that it does not mean every credential was valid or that every listed organization was breached. Whether those logins still work, and how many organizations were actually compromised, is not established in the reports.

Context matters too. [GBHackers](https://gbhackers.com/k0t-credential-theft/) says researchers linked some compromises to the FortiBleed cluster, which was reported in June, with many FortiGate compromises occurring between February and June 2026. The newly found credential dataset is not tied to FortiBleed or other tracked actors, according to the same report.

Counts for the wider FortiBleed campaign also conflict. One outlet cites 86,644 devices, while another describes 70,000 to 75,000 devices across as many as 194 countries. Neither figure has been checked against a primary source, so this story does not rely on either one.

## CVE-2026-0257 and the GlobalProtect patch status

| Vulnerability | Affected product | What the reports say |
| --- | --- | --- |
| CVE-2026-0257 | Palo Alto Networks PAN-OS GlobalProtect | Authentication bypass, patched in May; active exploitation confirmed by Palo Alto Networks |
| CVE-2025-64446 | Fortinet FortiWeb | Exploitation attempted in the k0t campaign; check the vendor advisory for fixed versions |

Palo Alto Networks separately confirmed active exploitation of CVE-2026-0257, according to Cyberpress. The flaw affects certain portal and gateway configurations where authentication override cookies are enabled and a specific certificate configuration exists.

[Help Net Security](https://helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257) reports that several ransomware groups have been exploiting the flaw since June, even though it was patched in May. A device that was exploited before the fix can still hold credentials the attacker already took, so patching alone does not close the exposure.

USA 24 has covered the ransomware side of this flaw in [Ransomware Crews Use Palo Alto PAN-OS Flaw to Reach Domain Credentials](https://usa-24.com/palo-alto-pan-os-ransomware-attacks/). The k0t campaign is the credential-theft side of the same device family, and it adds FortiGate and FortiWeb to the list of devices that need attention.

## How to rotate firewall admin credentials after k0t

Work through these steps in order. Patching comes first, because rotating passwords on a device that remains open to the same flaw buys little.

1. Inventory every internet-facing FortiGate, FortiWeb and GlobalProtect device, including management interfaces and VPN portals.
2. Compare each device's firmware and configuration against the vendor advisories for CVE-2026-0257 and CVE-2025-64446. On GlobalProtect, check whether authentication override cookies are enabled and whether the certificate configuration matches the affected setup.
3. Rotate LDAP, Active Directory and administrator credentials on affected devices, as [SecurityOnline](https://securityonline.info/k0t-fortigate-globalprotect-attacks/) recommends. Also rotate VPN accounts and any service accounts the devices use to bind to directory services.
4. Review logs for unusual administrator logins, new SSH keys or MeshCentral agents, and large outbound transfers. The sources point toward hunting for persistence and exfiltration but do not offer a full checklist, so fold these checks into your standard detection process.
5. Restrict management interfaces to an internal admin network or a dedicated management tunnel wherever the product allows it.

## What to watch next, including the VinSolutions claim

Several questions will shape the next few weeks. Will a primary report from Group-IB or NyxLab confirm how many of the 70,000 records are valid? Will the conflicting FortiBleed device counts be reconciled? Do the ransomware links firm up? And which US sectors and companies show up among victims? The reports describe global, multi-sector targeting without naming US victims, so that last answer is still open.

A separate and unverified claim deserves attention. [Class Action U](https://classactionu.org/current-data-breaches/vinsolutions/) reports on a VinSolutions data breach lawsuit, updated October 23, 2026. A threat actor calling itself ScarlettGroup claims it stole customer Social Security numbers and dealer credentials from VinSolutions, a Cox Automotive dealer CRM. VinSolutions has not confirmed a breach, and [Ransomware.live](https://www.ransomware.live/id/dmluc29sdXRpb25zLmNvbUBTY2FybGV0dGdyb3Vw) lists vinsolutions.com as a victim. It is a US story to track, but it is not part of the k0t campaign.

The pattern is familiar. USA 24 recently reported that a [Citrix NetScaler zero-day is still planting web shells on US VPN gateways](https://usa-24.com/cve-2026-88771-netscaler-zero-day-exploit/), and edge devices keep appearing in breach reports for the same reason: they face the internet and hold the keys. Expect more detail on k0t's targets as vendors publish fuller advisories and researchers test which stolen logins still work.

## Frequently asked questions

### Were FortiGate credentials stolen in the k0t campaign?

The disclosure reports more than 70,000 exposed credentials and related records from a campaign that targeted FortiGate, FortiWeb and GlobalProtect devices. Attackers also tried to brute-force FortiGate logins. Researchers caution that the figure does not mean every credential was valid or that every listed organization was breached.

### How do I rotate firewall admin credentials after a breach like this?

Patch the affected device first, then rotate administrator, LDAP and Active Directory credentials on that device, as SecurityOnline recommends. Include VPN accounts and service accounts that bind to directory services. After rotation, review logs for unusual administrator logins, new SSH keys and MeshCentral agents.

### What is CVE-2026-0257?

CVE-2026-0257 is an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect. It affects certain portal and gateway configurations where authentication override cookies are enabled and a specific certificate configuration exists. Help Net Security reports it was patched in May, and several ransomware groups have exploited it since June.

### Is the k0t group linked to ransomware?

Ransomware links are unconfirmed. SecurityOnline describes k0t as a suspected initial access broker, and no arrests or charges have been reported. Decryption Digest says stolen access is being sold to Qilin and Inc, but no other source verifies that claim.

### Has VinSolutions confirmed a data breach?

No. A threat actor calling itself ScarlettGroup claims it stole customer Social Security numbers and dealer credentials, and a Ransomware.live entry lists vinsolutions.com as a victim. VinSolutions, a Cox Automotive dealer CRM, has not confirmed a breach, and the claim is not part of the k0t campaign.

## Sources

1. [Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html)
2. [k0t Campaign Targets FortiGate and GlobalProtect](https://cypro.co.uk/insights/cyber-bulletins/k0t-campaign-targets-fortigate-and-globalprotect/)
3. [k0t-Linked Campaign Targets Fortinet and GlobalProtect Systems to Steal Credentials](https://mallory.ai/stories/01a1627c-e4f5-7be3-8afe-73747fce13a1)
4. [Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect, Exposing 70,000+ Credentials](https://cyberpress.org/hackers-expose-70000-credentials/)
5. [K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign](https://gbhackers.com/k0t-credential-theft/)
6. [Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials](https://securityonline.info/k0t-fortigate-globalprotect-attacks/)
7. [FortiGate GlobalProtect Credential Dump: k0t Exposes 70K](https://www.decryptiondigest.com/blog/fortigate-globalprotect-credentials-exposed-k0t)
8. [SimplySecure Group reproduction of The Hacker News article](https://simplysecuregroup.com/hackers-breach-enterprise-firewalls-and-vpns-exposing-over-70000-credentials/)
9. [Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June](https://helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257)
10. [VinSolutions Data Breach Lawsuit](https://classactionu.org/current-data-breaches/vinsolutions/)
11. [Victim: vinsolutions.com](https://www.ransomware.live/id/dmluc29sdXRpb25zLmNvbUBTY2FybGV0dGdyb3Vw)