More than 70,000 exposed credentials and LDAP dumps have been tied to a single, large-scale campaign that targeted internet-facing firewalls and VPN appliances, a joint investigation by Group-IB and NyxLab found.
The actor: k0t, aliases, and early footprint
Researchers attribute the widespread exploitation to a threat actor known as k0t, who also operates under the aliases CryptoFeel, Member19, and QazWsxShop. According to Group-IB and NyxLab, k0t was first observed in the wild on October 22, 2025, and is assessed to act as an initial access broker or an affiliate. The teams note links between k0t and ransomware groups Qilin and The Gentlemen, although "the exact nature of the connection between the threat and these gangs is unclear."
Analysis of the actor's dark‑web activity shows a pattern of commerce and tooling: k0t has demonstrated "a keen interest in purchasing vulnerability exploit code and tools or premium accounts for metadata search engines like FOFA and ZoomEye," the researchers reported.
Reconnaissance and exploited flaws: FOFA, ZoomEye, CVE-2025-64446, CVE-2026-0257
Group-IB and NyxLab describe a methodical, at-scale approach to target selection. The actor uses public scanning and metadata engines such as FOFA and ZoomEye to enumerate internet-facing network appliances, filter candidates by product, and assemble lists of potentially vulnerable VPN and firewall devices. The investigators name two specific vulnerabilities used in exploitation:
- CVE-2025-64446 — a path traversal flaw in FortiWeb
- CVE-2026-0257 — an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access
Exploitation was carried out with bespoke Python scripts identified as "fortnew.py" and "exploit_2026_0257.py," as well as through brute-force attempts using common credential combinations.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAttack chain, tools, and data exfiltration
The researchers lay out a multi-stage attack chain that begins with large-scale reconnaissance and proceeds to persistent access and data theft. Key steps and tooling cited in the report include:
- Initial access: exploiting the vulnerabilities above or brute-forcing credentials to gain entry.
- Foothold: establishing an OpenConnect VPN connection into compromised networks.
- Post-exploitation: enumeration of Active Directory, SMB shares, and installed antivirus solutions; use of administrator and pentesting utilities such as NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to move laterally.
- Persistence: installing legitimate remote‑access and management agents — MeshCentral Agent, Atera, Teramind, and AnyDes — and deploying an open-source adversary‑emulation framework called AdaptixC2.
- Exfiltration: transferring harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.
Group-IB and NyxLab also reported that "operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration."
Victim profile and overlap with FortiBleed
The campaign's targeting was device-centric rather than sector-specific: "k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations," the researchers said. They add that the actor's stated geographic priorities begin with the United States and Canada, followed by European countries and selected APAC markets, but the observed compromises skewed differently.
Geographic breakdown of victims identified in the investigation shows nearly 38% in the Asia Pacific region, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa. A significant portion of compromises occurred between February and June 2026, a period that overlaps with a separate credential‑harvesting activity tracked as FortiBleed. Group-IB and NyxLab report a "negligible overlap" in compromised data between this campaign and FortiBleed, suggesting this may be a distinct dataset, an operator subset, or a related access operation within the broader FortiBleed cluster.
In total, investigators identified more than 70,000 exposed credentials associated with network devices and LDAP dumps in connection with the campaign.
What this means for technologists, procurement leaders, and policymakers
- Technologists and security teams: the report underscores that exposed product/instance location — not industry vertical — can be the decisive risk factor. Teams should prioritize discovery and remediation of internet‑facing VPN and firewall appliances, watch for the specific persistence tools named, and monitor for unusual use of OpenConnect VPN sessions and Rclone transfers into Wasabi or MEGA.
- Procurement and asset owners: because k0t targets devices by product and exposure, procurement decisions and inventory hygiene that reduce internet exposure of management interfaces will materially affect risk. Patch and configuration management for FortiWeb, Palo Alto PAN‑OS/Prisma Access, and other edge appliances should be enforced.
- Policymakers and regulators: the transnational footprint — with high concentrations in APAC and Latin America and a stated priority for North America and Europe — highlights the cross‑border nature of access-broker activity and the downstream risk when compromised organizations later appear on ransomware leak sites.
Group-IB and NyxLab conclude with an operational recommendation: "Organisations are advised to act on ensuring that any vulnerabilities mentioned in this report are appropriately remedied."
The investigation documents an actor focused on scale — using commodity scanners to find exposed appliances, automated exploit scripts and brute force, and a mix of legitimate and offensive tooling to gain, keep, and monetize access. The remaining open question is how closely k0t coordinates with ransomware affiliates such as Qilin and The Gentlemen; victims tied to this campaign later appeared on those groups' leak sites, but the researchers leave the precise relationship unresolved.
