{"id":2145,"date":"2026-10-24T07:21:08","date_gmt":"2026-10-24T00:21:08","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-k0t-firewall-vpn-70000-thong-tin-xac-thuc\/"},"modified":"2026-10-24T07:21:08","modified_gmt":"2026-10-24T00:21:08","slug":"k0t-profile-firewall-vpn-70000-credentials","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-k0t-firewall-vpn-70000-thong-tin-xac-thuc\/","title":{"rendered":"k0t Profile: Firewall and VPN Breach Campaign Exposes Over 70,000 Credentials"},"content":{"rendered":"

Group-IB and NyxLab have published a profile of k0t, a threat actor suspected of operating as an initial access broker. The campaign targets FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices, harvesting more than 70,000 credentials and related records, maintaining access to corporate networks, and exfiltrating data to cloud storage services.<\/strong><\/p>\n

\"k0t's
The observed chain spans edge-device reconnaissance, exploitation or password guessing, privilege expansion, persistent access, and data theft. Source: Group-IB and NyxLab.<\/figcaption><\/figure>\n

Who Is k0t?<\/h2>\n

Group-IB tracks the actor as k0t and notes potentially related aliases including CryptoFeel, Member19, and QazWsxShop. Underground-forum activity shows a key operator seeking exploit tools, lists of internet-exposed devices, and collaborators with different skills. Researchers have not attributed k0t to a specific country or organization.<\/p>\n

Available evidence points mainly to a financial motive. Some victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups, but Group-IB stresses that no direct relationship has been confirmed. The most cautious assessment is that the operators may provide or sell initial access to other criminals.<\/p>\n

Scale and Victim Profile<\/h2>\n

The investigation uncovered more than 70,000 credentials and related data involving network devices and LDAP dumps. Victims span many regions and industries because k0t prioritizes product type, geography, and device exposure instead of researching each organization in depth.<\/p>\n

Many FortiGate compromises were dated between February and June 2026, overlapping with the previously reported FortiBleed cluster. The new report, however, describes a broader scope covering FortiGate, FortiWeb, and GlobalProtect; the timing overlap alone is insufficient to conclude that the two clusters are identical.<\/p>\n

Mass Reconnaissance Instead of Target Selection<\/h2>\n

k0t uses attack-surface search engines such as FOFA, ZoomEye, and Censys to collect IP addresses and ports for internet-exposed firewalls and VPNs. Lists are filtered by product and country, then fed into automated checking tools. GlobalProtect is a prominent target alongside FortiWeb, FortiGate, and products such as SonicWall SMA1000, OPNsense, and Cisco ISE.<\/p>\n

This approach makes every weakly configured or slowly patched edge device a candidate regardless of industry. Group-IB notes that appearing in scan results does not mean a host was attacked; evidence of compromise must come from logs, accounts, configurations, and post-exploitation activity.<\/p>\n

Two Paths to Initial Access<\/h2>\n

For FortiWeb, a tool named \u201cFortiGate Security Scanner\u201d attempts to exploit CVE-2025-64446, a relative path traversal flaw that can allow administrator-account creation through a crafted HTTP or HTTPS request. If that fails, the tool switches to password guessing against the Fortinet REST API and deliberately waits out the default lockout interval before retrying.<\/p>\n

For GlobalProtect, researchers observed exploitation of CVE-2026-0257 against vulnerable PAN-OS configurations. The tool forges an authentication cookie to log in to the VPN portal, then uses OpenConnect to establish a connection. Exploitability depends on authentication-override and certificate settings, so not every GlobalProtect portal is affected.<\/p>\n

From Firewall Configuration to Domain Accounts<\/h2>\n

Sau khi v\u00e0o \u0111\u01b0\u1ee3c thi\u1ebft b\u1ecb Fortinet, c\u00f4ng c\u1ee5 c\u00f3 th\u1ec3 t\u1ea3i c\u1ea5u h\u00ecnh v\u00e0 gi\u1ea3i m\u00e3 b\u00ed m\u1eadt ngo\u1ea1i tuy\u1ebfn b\u1eb1ng kh\u00f3a AES m\u1eb7c \u0111\u1ecbnh c\u1ee7a FortiOS. \u0110i\u1ec3m y\u1ebfu n\u00e0y \u0111\u01b0\u1ee3c theo d\u00f5i d\u01b0\u1edbi CVE-2019-6693; n\u1ebfu t\u00f9y ch\u1ecdn private-data-encryption<\/code> ch\u01b0a \u0111\u01b0\u1ee3c b\u1eadt v\u1edbi kh\u00f3a ri\u00eang, t\u1ec7p c\u1ea5u h\u00ecnh b\u1ecb l\u1ea5y c\u1eafp c\u00f3 th\u1ec3 l\u00e0m l\u1ed9 t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb, ng\u01b0\u1eddi d\u00f9ng c\u1ee5c b\u1ed9 v\u00e0 th\u00f4ng tin li\u00ean k\u1ebft LDAP ho\u1eb7c Active Directory.<\/p>\n

Inside the network, the operators use legitimate administration and testing tools including NetExec, Impacket, Kerbrute, Mimikatz, and noPac. CVE-2021-42278 and CVE-2021-42287 can be chained to escalate privileges to Domain Admin. This is a form of living off trusted tools, making software-name-only blocking ineffective.<\/p>\n

Persistence and Data Exfiltration<\/h2>\n

MeshCentral, Atera, and AnyDesk are used to maintain remote control. At the time of analysis, the related MeshCentral server held 28 active device groups containing 84 compromised systems; artifacts indicated that another 100 device groups had been removed. This infrastructure mainly supported interactive shell and RDP access.<\/p>\n

Data is transferred separately with Rclone to Wasabi S3 buckets and MEGA drives. Because OpenConnect, MeshCentral, AnyDesk, and Rclone all have legitimate uses, defenders should evaluate installation source, execution account, destination, timing, and behavioral sequence rather than treating a tool's presence alone as proof of compromise.<\/p>\n

Technical, Economic, and Trust Impact<\/h2>\n

Edge devices are trusted gateways that often hold high-value secrets. When a firewall or VPN is compromised, the incident can spread to enterprise identities, file servers, administrator workstations, and backup systems. Costs therefore extend beyond restoring the appliance to investigation, credential rotation, operational disruption, and extortion risk.<\/p>\n

Abuse of legitimate tools also weakens simple security signals. Organizations need to combine edge-device, VPN, identity, endpoint, and cloud-traffic logs to reconstruct the event chain while avoiding ransomware attribution without evidence.<\/p>\n

Immediate Actions for Organizations<\/h2>\n
    \n
  • Ki\u1ec3m k\u00ea b\u1ec1 m\u1eb7t Internet:<\/strong> x\u00e1c \u0111\u1ecbnh m\u1ecdi FortiGate, FortiWeb v\u00e0 GlobalProtect \u0111ang l\u1ed9 ra ngo\u00e0i; \u0111\u01b0a giao di\u1ec7n qu\u1ea3n tr\u1ecb kh\u1ecfi Internet n\u1ebfu \u0111i\u1ec1u ki\u1ec7n v\u1eadn h\u00e0nh cho ph\u00e9p.<\/li>\n
  • V\u00e1 v\u00e0 ki\u1ec3m tra c\u1ea5u h\u00ecnh:<\/strong> \u00e1p d\u1ee5ng b\u1ea3n s\u1eeda c\u1ee7a nh\u00e0 cung c\u1ea5p cho c\u00e1c CVE li\u00ean quan, r\u00e0 so\u00e1t authentication override v\u00e0 gi\u1edbi h\u1ea1n ngu\u1ed3n c\u00f3 th\u1ec3 truy c\u1eadp qu\u1ea3n tr\u1ecb.<\/li>\n
  • B\u1ea3o v\u1ec7 b\u00ed m\u1eadt FortiGate:<\/strong> b\u1eadt private-data-encryption<\/code> v\u1edbi kh\u00f3a do t\u1ed5 ch\u1ee9c qu\u1ea3n l\u00fd. N\u1ebfu c\u1ea5u h\u00ecnh t\u1eebng b\u1ecb l\u1ea5y c\u1eafp, ph\u1ea3i coi \u0111\u00e2y l\u00e0 s\u1ef1 c\u1ed1 l\u1ed9 th\u00f4ng tin x\u00e1c th\u1ef1c v\u00e0 lu\u00e2n chuy\u1ec3n m\u1ecdi t\u00e0i kho\u1ea3n \u0111\u01b0\u1ee3c tham chi\u1ebfu.<\/li>\n
  • S\u0103n t\u00ecm h\u00e0nh vi:<\/strong> r\u00e0 so\u00e1t t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb m\u1edbi, \u0111\u0103ng nh\u1eadp VPN b\u1ea5t th\u01b0\u1eddng, OpenConnect kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t, ti\u1ebfn tr\u00ecnh Rclone v\u00e0 k\u1ebft n\u1ed1i t\u1edbi Wasabi S3 ho\u1eb7c MEGA sau ho\u1ea1t \u0111\u1ed9ng truy c\u1eadp th\u00f4ng tin x\u00e1c th\u1ef1c.<\/li>\n
  • \u1ee8ng ph\u00f3 theo ph\u1ea1m vi:<\/strong> c\u00f4 l\u1eadp thi\u1ebft b\u1ecb nghi v\u1ea5n, b\u1ea3o to\u00e0n log, ki\u1ec3m tra LDAP\/AD, endpoint v\u00e0 m\u00e1y ch\u1ee7 t\u1ec7p; kh\u00f4ng ch\u1ec9 c\u00e0i l\u1ea1i firewall r\u1ed3i k\u1ebft lu\u1eadn \u0111\u00e3 x\u1eed l\u00fd xong.<\/li>\n<\/ul>\n

    Lessons from the k0t Profile<\/h2>\n

    The campaign shows that edge devices are no longer passive protection layers but the first targets in an automated criminal pipeline. Broad scanning, exploitation of known flaws, and password guessing can quickly lead to domain-administrator access when configurations contain recoverable secrets.<\/p>\n

    The central lesson is that attack-surface management must be paired with patching, identity protection, and post-exploitation monitoring. An organization truly closes the incident only after validating devices, rotating affected secrets, hunting through the internal network, and controlling data-exfiltration channels.<\/p>\n

    VNCyberS<\/strong> compiled from Group-IB, NyxLab, and The Hacker News<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    Nh\u00f3m nghi\u00ean c\u1ee9u Group-IB v\u00e0 NyxLab v\u1eeba c\u00f4ng b\u1ed1 h\u1ed3 s\u01a1 v\u1ec1 k0t, m\u1ed9t t\u00e1c nh\u00e2n b\u1ecb nghi ho\u1ea1t \u0111\u1ed9ng nh\u01b0 nh\u00e0 m\u00f4i gi\u1edbi quy\u1ec1n truy c\u1eadp ban \u0111\u1ea7u. Chi\u1ebfn d\u1ecbch nh\u1eafm v\u00e0o thi\u1ebft b\u1ecb bi\u00ean FortiGate, FortiWeb v\u00e0 Palo Alto GlobalProtect, qua \u0111\u00f3 thu th\u1eadp h\u01a1n 70.000 th\u00f4ng tin x\u00e1c th\u1ef1c v\u00e0 d\u1eef li\u1ec7u […]<\/p>\n","protected":false},"author":2,"featured_media":2144,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[1005,1006,1002,1003,1004,1007,1001,1008],"class_list":["post-2145","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-cve-2025-64446","tag-cve-2026-0257","tag-fortigate","tag-fortiweb","tag-globalprotect","tag-initial-access-broker","tag-k0t","tag-rclone"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2145"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2145\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2144"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}