Suspected Access Broker k0t Hits FortiGate and GlobalProtect Devices, Exposing 70,000 Credentials
Do Son 
General attack chain observed by campaign operators | Image: Group-IB
| At a glance | |
| Actor | Operator using the alias “k0t,” with suspected collaborators; possible initial access broker |
| Activity | Mass scanning, exploitation, and brute-forcing of network edge devices; persistence and data theft |
| Targets | Organizations worldwide running FortiGate, FortiWeb, and Palo Alto GlobalProtect |
| Scale | 70,000+ exposed credentials; 84 devices in 28 active groups on one control server |
| Status | No arrests or charges reported; ransomware links unconfirmed |
| Source | Group-IB Threat Intelligence and NyxLab, with comparison to Fortinet’s FortiBleed assessment |
TL;DR
Group-IB and NyxLab have uncovered a large campaign of FortiGate and GlobalProtect attacks tied to an operator known as “k0t.” The investigation found more than 70,000 exposed credentials and persistent access to many corporate networks. Researchers suspect the crew works as an initial access broker, but its ransomware ties remain unconfirmed.
What happened
Many of the FortiGate compromises date from February to June 2026. That window overlaps with the widely reported FortiBleed campaign. However, Group-IB found only “negligible overlap” between the two credential sets.
Picking targets by product, not industry
The operators did not research individual firms. Instead, they used attack-surface search engines such as FOFA and ZoomEye to list exposed VPN and firewall devices in bulk. According to Group-IB, k0t’s stated priorities began with the US and Canada, followed by Europe and parts of Asia-Pacific.
In public forum posts, k0t reportedly sought premium FOFA access and bulk IP exports. He also endorsed underground services that sell product-filtered IP lists. Custom checkers then cut those lists down to likely targets.
Breaking into Fortinet devices
A custom script called “FortiGate Security Scanner” handled Fortinet targets. First, it tried to exploit CVE-2025-64446, a path traversal flaw in FortiWeb. A successful attempt created a new administrator that could log in from anywhere.
If that failed, the tool fell back to brute-forcing with common usernames and passwords. It even paused for 60 seconds after a lockout, matching FortiGate’s default timer. Group-IB says this shows the developer “possesses significant technical knowledge about the FortiGate appliances.”
After logging in, the tool could download the device configuration. It then decrypted stored secrets with a known default key, tracked as CVE-2019-6693. That exposed LDAP, Active Directory, and admin credentials.
Forging GlobalProtect cookies
For Palo Alto devices, the operators used a tool to exploit CVE-2026-0257. The flaw lets attackers forge an authentication cookie on vulnerable GlobalProtect setups. The tool then opened a VPN session through OpenConnect.
Inside the network
Once inside, the operators worked hands-on-keyboard. They used NetExec, Impacket, Kerbrute, PetitPotam, Mimikatz, and noPac to steal credentials and reach domain admin. To stay in, they installed MeshCentral agents, AdaptixC2, and RMM tools such as Atera and AnyDesk. In the worst cases, they copied data out with Rclone to Wasabi and MEGA cloud storage.
Who is behind it
Group-IB names k0t as likely one of the main operators. It also links the aliases “CryptoFeel” and “Scrooge” to the activity. However, those links are preliminary, and no one has been charged.
The tools themselves name other developers, “BH” and “BeiDou.” Group-IB says these may be freelancers who sell to several groups. It has not tied them directly to the campaign.
The ransomware question also remains open. Many victims later appeared on the leak sites of Qilin and The Gentlemen. Even so, Group-IB says the relationship “is still unconfirmed.” Current evidence suggests the operators are “likely to be acting as Initial Access Brokers.”
Group-IB also assesses with moderate confidence that the cluster links to the broader FortiBleed activity. Still, the evidence “does not establish that the same operators controlled both datasets.”
Impact and scale
Exact victim counts from the FortiGate and GlobalProtect attacks are hard to pin down. Victim identifiers ranged from domains to internal IPs. Group-IB therefore treats its count of unique domains as a lower bound.
One MeshCentral server alone held 84 compromised devices across 28 active groups. Records also showed 100 more groups that had been removed. Asia-Pacific accounted for 37.6% of unique domains, followed by Latin America. Group-IB warns this likely reflects exposed devices, not deliberate regional targeting.
How to stay protected
Recommended steps include:
- Patch FortiWeb for CVE-2025-64446 and PAN-OS for CVE-2026-0257.
- Enable FortiOS private-data encryption so stored secrets do not use the default key.
- Remove management interfaces from direct internet access.
- Review new admin accounts, config exports, and trusted-host changes on edge devices.
- Rotate LDAP, Active Directory, and admin credentials tied to any exposed appliance.
- Hunt for unapproved MeshAgent, AdaptixC2, Atera, AnyDesk, and Rclone use.
NyxLab sums up the stakes: an edge device breach “should be treated as a potential enterprise credential compromise, not only as an appliance-patching event.” In short, these FortiGate and GlobalProtect attacks show how one weak firewall can open the door to ransomware.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
