Threat Pulse 62High
k0t campaign breaches Fortinet and Palo Alto edge devices worldwide; 70,000+ credentials exposed
Severity 5ActiveconfirmedWeb servers and gateways

Group-IB traced a campaign linked to the k0t actor that gets in through FortiWeb (CVE-2025-64446), brute-forced FortiGate logins and the Palo Alto GlobalProtect bypass (CVE-2026-0257), establishes a foothold over OpenConnect VPN, enumerates Active Directory and file shares, persists through RMM tools and exfiltrates data, with suspected ransomware links. More than 70,000 exposed credentials were identified.

What to do: Patch, rotate credentials, restrict management access. CERT-In CIAD-2026-0054 (Oct 24): urgent Fortinet hardening releases for FortiOS, FortiManager, FortiMail, FortiAuthenticator and FortiAnalyzer; CVE ids due Nov 10.

· 13 days ago · 70,000+ exposed firewall logins · Cypro bulletin: k0t campaign
SourcesCypro bulletin: k0t campaigngroup-ib.comthehackernews.comcert-in.org.inPalo Alto Unit 42
On X
@DailyDarkWebunverified
Open on X
@DEVOTOMSOLUTIONverifiedOct 24, 04:05 UTC

k0t is mass-exploiting exposed FortiWeb & GlobalProtect devices (CVE-2025-64446, CVE-2026-0257), 70,000+ credentials tied to the campaign, links to Qilin ransomware. Patch, enforce VPN MFA, rotate creds. #Fortinet #

Open on X
@TheHackersNewsverifiedOct 23, 13:52 UTC

Hackers breached enterprise firewalls and VPNs worldwide in a campaign linked to k0t. Over 70,000 exposed credentials identified.

Open on X
Why this score

Edge firewalls at scale, active, credentials exposed

Back to the board

Updated Nov 5, 01:48 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.