Group-IB and NyxLab have published a profile of k0t, a threat actor suspected of operating as an initial access broker. The campaign targets FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices, harvesting more than 70,000 credentials and related records, maintaining access to corporate networks, and exfiltrating data to cloud storage services.
Who Is k0t?
Group-IB tracks the actor as k0t and notes potentially related aliases including CryptoFeel, Member19, and QazWsxShop. Underground-forum activity shows a key operator seeking exploit tools, lists of internet-exposed devices, and collaborators with different skills. Researchers have not attributed k0t to a specific country or organization.
Available evidence points mainly to a financial motive. Some victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups, but Group-IB stresses that no direct relationship has been confirmed. The most cautious assessment is that the operators may provide or sell initial access to other criminals.
Scale and Victim Profile
The investigation uncovered more than 70,000 credentials and related data involving network devices and LDAP dumps. Victims span many regions and industries because k0t prioritizes product type, geography, and device exposure instead of researching each organization in depth.
Many FortiGate compromises were dated between February and June 2026, overlapping with the previously reported FortiBleed cluster. The new report, however, describes a broader scope covering FortiGate, FortiWeb, and GlobalProtect; the timing overlap alone is insufficient to conclude that the two clusters are identical.
Mass Reconnaissance Instead of Target Selection
k0t uses attack-surface search engines such as FOFA, ZoomEye, and Censys to collect IP addresses and ports for internet-exposed firewalls and VPNs. Lists are filtered by product and country, then fed into automated checking tools. GlobalProtect is a prominent target alongside FortiWeb, FortiGate, and products such as SonicWall SMA1000, OPNsense, and Cisco ISE.
This approach makes every weakly configured or slowly patched edge device a candidate regardless of industry. Group-IB notes that appearing in scan results does not mean a host was attacked; evidence of compromise must come from logs, accounts, configurations, and post-exploitation activity.
Two Paths to Initial Access
For FortiWeb, a tool named “FortiGate Security Scanner” attempts to exploit CVE-2025-64446, a relative path traversal flaw that can allow administrator-account creation through a crafted HTTP or HTTPS request. If that fails, the tool switches to password guessing against the Fortinet REST API and deliberately waits out the default lockout interval before retrying.
For GlobalProtect, researchers observed exploitation of CVE-2026-0257 against vulnerable PAN-OS configurations. The tool forges an authentication cookie to log in to the VPN portal, then uses OpenConnect to establish a connection. Exploitability depends on authentication-override and certificate settings, so not every GlobalProtect portal is affected.
From Firewall Configuration to Domain Accounts
Sau khi vào được thiết bị Fortinet, công cụ có thể tải cấu hình và giải mã bí mật ngoại tuyến bằng khóa AES mặc định của FortiOS. Điểm yếu này được theo dõi dưới CVE-2019-6693; nếu tùy chọn private-data-encryption chưa được bật với khóa riêng, tệp cấu hình bị lấy cắp có thể làm lộ tài khoản quản trị, người dùng cục bộ và thông tin liên kết LDAP hoặc Active Directory.
Inside the network, the operators use legitimate administration and testing tools including NetExec, Impacket, Kerbrute, Mimikatz, and noPac. CVE-2021-42278 and CVE-2021-42287 can be chained to escalate privileges to Domain Admin. This is a form of living off trusted tools, making software-name-only blocking ineffective.
Persistence and Data Exfiltration
MeshCentral, Atera, and AnyDesk are used to maintain remote control. At the time of analysis, the related MeshCentral server held 28 active device groups containing 84 compromised systems; artifacts indicated that another 100 device groups had been removed. This infrastructure mainly supported interactive shell and RDP access.
Data is transferred separately with Rclone to Wasabi S3 buckets and MEGA drives. Because OpenConnect, MeshCentral, AnyDesk, and Rclone all have legitimate uses, defenders should evaluate installation source, execution account, destination, timing, and behavioral sequence rather than treating a tool's presence alone as proof of compromise.
Technical, Economic, and Trust Impact
Edge devices are trusted gateways that often hold high-value secrets. When a firewall or VPN is compromised, the incident can spread to enterprise identities, file servers, administrator workstations, and backup systems. Costs therefore extend beyond restoring the appliance to investigation, credential rotation, operational disruption, and extortion risk.
Abuse of legitimate tools also weakens simple security signals. Organizations need to combine edge-device, VPN, identity, endpoint, and cloud-traffic logs to reconstruct the event chain while avoiding ransomware attribution without evidence.
Immediate Actions for Organizations
- Kiểm kê bề mặt Internet: xác định mọi FortiGate, FortiWeb và GlobalProtect đang lộ ra ngoài; đưa giao diện quản trị khỏi Internet nếu điều kiện vận hành cho phép.
- Vá và kiểm tra cấu hình: áp dụng bản sửa của nhà cung cấp cho các CVE liên quan, rà soát authentication override và giới hạn nguồn có thể truy cập quản trị.
- Bảo vệ bí mật FortiGate: bật
private-data-encryptionvới khóa do tổ chức quản lý. Nếu cấu hình từng bị lấy cắp, phải coi đây là sự cố lộ thông tin xác thực và luân chuyển mọi tài khoản được tham chiếu. - Săn tìm hành vi: rà soát tài khoản quản trị mới, đăng nhập VPN bất thường, OpenConnect không được phê duyệt, tiến trình Rclone và kết nối tới Wasabi S3 hoặc MEGA sau hoạt động truy cập thông tin xác thực.
- Ứng phó theo phạm vi: cô lập thiết bị nghi vấn, bảo toàn log, kiểm tra LDAP/AD, endpoint và máy chủ tệp; không chỉ cài lại firewall rồi kết luận đã xử lý xong.
Lessons from the k0t Profile
The campaign shows that edge devices are no longer passive protection layers but the first targets in an automated criminal pipeline. Broad scanning, exploitation of known flaws, and password guessing can quickly lead to domain-administrator access when configurations contain recoverable secrets.
The central lesson is that attack-surface management must be paired with patching, identity protection, and post-exploitation monitoring. An organization truly closes the incident only after validating devices, rotating affected secrets, hunting through the internal network, and controlling data-exfiltration channels.
VNCyberS compiled from Group-IB, NyxLab, and The Hacker News
Tiếng Việt
English