k0t Walks In Through Fortinet and GlobalProtect, Leaves With 70,000 Logins

A threat actor called k0t has spent much of 2026 breaking into companies through their firewalls and VPN portals and then working toward domain admin, according to a joint investigation by Group-IB and NyxLab. The researchers say k0t doesn’t pick victims so much as scan for exposed Fortinet and Palo Alto GlobalProtect devices and walk through whichever ones open, and that most compromises happened between February and June. As The Hacker News notes, the haul runs to more than 70,000 stolen credentials. They assess k0t is most likely an initial access broker, and note victim overlap with the Qilin and The Gentlemen leak sites without confirming any affiliation.

mesh[.]buttruyen[.]com
agent[.]afahimsa[.]top
sthyjk[.]com
radesashar[.]com
62[.]60[.]131[.]43
64[.]94[.]85[.]14
168[.]100[.]11[.]99
193[.]149[.]187[.]81

Source article: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Publisher: Group-IB, with NyxLab (authors Tsai Shun Ling and Nikolay Kichatov; contributors KT Gan and Chris Au, NyxLab)
Published: Oct. 21, 2026
URL: https://www.group-ib.com/blog/stray-cat-network-edge/

Executive Summary

k0t is a financially motivated intrusion operator, also seen under the alias CryptoFeel (possibly the same person) and working with a likely collaborator known as Scrooge or ScroogeMcDuck, that Group-IB and NyxLab assess is most likely an initial access broker. Rather than choosing victims, k0t buys or builds ip:port target lists from FOFA, ZoomEye, Censys and underground list services (AccessTracker, FortiSSL), prioritizing the US and Canada, then Europe and parts of APAC, and runs them through custom scanners against internet-exposed FortiWeb, FortiGate and Palo Alto GlobalProtect devices; most FortiGate compromises date from February to June 2026, and the operation has amassed more than 70,000 credentials. Access comes three ways: CVE-2025-64446 path traversal on FortiWeb to create a rogue local admin, REST API brute-forcing of FortiGate followed by config download and offline decryption of stored LDAP and admin secrets with the default FortiOS key (CVE-2019-6693), and forged GlobalProtect authentication-override cookies for CVE-2026-0257, after which the operator connects with OpenConnect. Inside, k0t uses NetExec, SoftPerfect, Impacket (GetUserSPNs, secretsdump), Kerbrute, PetitPotam relayed to AD CS, noPac (CVE-2021-42278/42287) and Mimikatz to reach domain admin, keeps access with self-hosted MeshCentral, AdaptixC2, Atera, Teramind, AnyDesk and ngrok, and moves data out with Rclone to Wasabi S3 and MEGA. Victim overlap with the Qilin and The Gentlemen leak sites suggests the access is resold to ransomware crews, though no affiliation is confirmed. Hunt leads, false-positive expectations, the absence of published rules, and the indicators are detailed below.

ATT&CK chain: Reconnaissance → Resource Development → Initial Access → Execution → Persistence → Privilege Escalation → Credential Access → Discovery → Lateral Movement → Command and Control → Exfiltration

Hunt Lead Grid

k0t Infrastructure and Tool-Staging Sweep

Group-IB published the infrastructure behind k0t’s persistence and staging: MeshCentral C2 consoles at mesh[.]buttruyen[.]com (62[.]60[.]131[.]43) and Meshcentral[.]girydsfsggvb[.]com (62[.]60[.]135[.]64), Mesh agents hosted at agent[.]afahimsa[.]top (served from a /meshagents path with an id and meshid query string) and a second agent at hxxp://193[.]149[.]187[.]81:1287/1.exe, AdaptixC2 team servers at 64[.]94[.]85[.]14 (port 4321) and 168[.]100[.]11[.]99, the fake installer clear-thinking_61.92.4_INSTALL.exe served from hxxp://162[.]33[.]178[.]213:8888/ and hxxps://sthyjk[.]com:8443/, the associated domain alknene[.]shop, development and tool-staging hosts 162[.]33[.]179[.]249, 193[.]24[.]123[.]162 and 193[.]149[.]176[.]50, a Nezha dashboard C2 at radesashar[.]com, and a probable scanning host at 193[.]169[.]194[.]21. The detection logic is a retrospective sweep of DNS, proxy, firewall and NetFlow logs for any of these hosts, plus edge-appliance admin and VPN logs for the scanning host and staging addresses as sources, and an EDR file and hash search for the seven published hashes (see the Hash Appendix).

Use DNS resolver logs, web proxy logs, firewall and NetFlow records, FortiGate, FortiWeb and GlobalProtect system and VPN logs, and EDR file inventory. Sweep back to at least January 2026, since the FortiGate compromises began in February and an access broker may sit on access for months before selling it. Scope to everything, but treat outbound hits from servers and domain controllers as the highest priority because that is where MeshAgent and AdaptixC2 landed. Blocking the addresses is worthwhile but should not be the only control, since the actor rents servers cheaply (Group-IB notes BitLaunch hosting) and rotates them; the durable signal is the behavior in the later leads. Any outbound connection to a MeshCentral or AdaptixC2 host listed here should go straight to incident response as a confirmed foothold, and should also trigger the credential-rotation steps for the edge device it entered through.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Resource Development → T1583.004 (Acquire Infrastructure: Server) (mapping per source article); Command and Control → T1105 (Ingress Tool Transfer) (our mapping, for the installer and agent downloads)

Sources: “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”, Group-IB, Oct. 21, 2026, https://www.group-ib.com/blog/stray-cat-network-edge/ (source article)

FortiWeb fwbcgi Traversal and Rogue prof_admin Account

k0t’s scanner exploits CVE-2025-64446 on FortiWeb by sending a request to the encoded traversal path /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi with a forged CGIINFO header that impersonates the built-in prof_admin profile. The request creates a new local administrator whose username is a random 8-character string, whose password is identical to the username, with the prof_admin access profile and a trusted host of 0.0.0.0/0, and the tool then confirms the account works with a REST API login. The detection logic has two near-zero-noise halves: a web or WAF log search for any request whose path contains both “/api/v2.0/cmdb/system/admin” and “cgi-bin/fwbcgi” (decoded or encoded), and a FortiWeb configuration and event-log check for any admin account created outside change control, especially one with a random 8-character name, the prof_admin profile and a 0.0.0.0/0 or ::/0 trusted host, followed by a REST login for that account.

Use FortiWeb event and attack logs forwarded to the SIEM, any reverse proxy or load balancer logs in front of the FortiWeb management interface, and a direct export of the current admin account list compared against a known-good baseline. Sweep as far back as logs allow, and at least to January 2026, because a rogue admin outlives the patch: updating firmware does not delete accounts already created. Scope to every FortiWeb, with internet-exposed management interfaces first. False positives should be essentially nil, so do not tune this; instead, verify every unexplained admin account by name with the device owners. Blocking the scanner’s addresses is the wrong primary control because the target list approach means a new source will try again tomorrow; patching, taking management off the internet and removing rogue accounts are what close it. Any hit means the appliance should be treated as compromised: delete the account, review admin activity for its lifetime, and rotate every credential the device stores.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application) (mapping per source article); Persistence → T1136.001 (Create Account: Local Account) (mapping per source article)

Sources: “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”, Group-IB, Oct. 21, 2026, https://www.group-ib.com/blog/stray-cat-network-edge/ (source article)

Forged GlobalProtect Auth-Override Cookie Logins

For CVE-2026-0257, k0t’s tool exploit_2026_0257.py (self-described as a GlobalProtect scanner plus VPN connector, by a developer known as BeiDou) builds an authentication-override cookie by encrypting a plaintext containing the user “admin”, the OS “Windows”, a UNIX timestamp and the address 0.0.0.0 with the public key of the portal’s TLS certificate, submits it with an empty password to /ssl-vpn/login.esp, and, if accepted, connects with OpenConnect using --protocol=gp, --usergroup=portal:portal-userauthcookie and --os=win from a throwaway shell script that deletes the cookie file afterward. The bypass only works where authentication-override cookies and the matching certificate setting are enabled. The detection logic is a GlobalProtect log rule that flags a successful portal or gateway login authenticated by an override cookie where there was no prior interactive login for that user from the same source in the cookie’s lifetime, where the username is a generic name such as “admin”, or where the source is a hosting provider never seen before, and that raises severity when the client reports a generic “Windows” OS with no host-information profile data, which is typical of OpenConnect rather than the official agent.

Use PAN-OS GlobalProtect logs (the globalprotect log type records the authentication method, client OS, client version and host ID), system logs and the authentication logs of the identity provider behind the portal. Sweep 90 days, and further if the firewall ran a vulnerable version with override cookies enabled earlier in 2026, since other crews (Qilin and INC affiliates) were already abusing the same bug. Scope to every portal and gateway that has authentication-override cookies switched on. Cookie logins are normal for returning users, so do not alert on all of them; anchor on the missing prior login, the generic username and the missing host-information data, and allowlist known Linux or OpenConnect users explicitly by username, not by source. Turning off cookie-based override (or patching) is the real control; blocking OpenConnect by client string alone is the wrong one because the string is trivially changed. Any confirmed hit should be escalated: end the session, find the internal address it was assigned and pull all traffic from that address for the session window.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion / Lateral Movement → T1550.004 (Use Alternate Authentication Material: Web Session Cookie) (mapping per source article); Initial Access / Persistence → T1133 (External Remote Services) (mapping per source article)

Sources: “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”, Group-IB, Oct. 21, 2026, https://www.group-ib.com/blog/stray-cat-network-edge/ (source article)

Fake clear-thinking Installer and Unsanctioned MeshAgent or AdaptixC2

To keep access, k0t delivered an AdaptixC2 agent disguised as an installer named clear-thinking_61.92.4_INSTALL.exe, fetched with PowerShell and curl from a raw IP on port 8888 or a domain on port 8443, beaconing to a team server on port 4321 with listener paths /update, /api/v1/check and /uri.php and a default self-signed certificate whose subject is “O=Internet Widgits Pty Ltd”. In parallel, it ran a self-hosted MeshCentral server configured to auto-approve agents and skip agent hash checks, using it as a shell and RDP relay for 84 compromised devices across 28 device groups. The detection logic is an EDR rule for powershell.exe or curl.exe writing an executable whose name matches *_INSTALL.exe (or any executable) fetched from a bare IP address or a non-standard HTTPS port on a server or domain controller, joined to a network rule for TLS sessions presenting the “Internet Widgits Pty Ltd” default certificate subject, and a software-inventory rule for MeshAgent services (MeshAgent.exe, the “Mesh Agent” service) whose configured server is not an organization-owned MeshCentral instance.

Use EDR process, file and network events, Windows service-creation events (System 7045), TLS certificate metadata from a network sensor or proxy, and software inventory. Sweep 90 days, then run continuously. Scope first to servers, domain controllers and jump hosts, where an installer download by PowerShell is unusual. Expect benign matches from admins scripting installs; tune by allowlisting internal software repositories and signed vendor installers by publisher certificate, not by file name. The OpenSSL default subject also appears on lab and appliance certificates, so require it together with an outbound connection from a Windows endpoint to an external address. Hash-blocking MeshAgent is the wrong control because the binary is the legitimate open-source agent; detect the server it points to and the way it was installed instead. If the organization uses none of MeshCentral, Atera, Teramind, AnyDesk or ngrok, an application-control block on all of them closes the route. Any hit on a server or domain controller is an incident, not a tuning exercise.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1059.001 (Command and Scripting Interpreter: PowerShell) (mapping per source article); Command and Control → T1219 (Remote Access Tools) (mapping per source article)

Sources: “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”, Group-IB, Oct. 21, 2026, https://www.group-ib.com/blog/stray-cat-network-edge/ (source article)

FortiGate REST API Spray With 60-Second Lockout Retry, Then Config Pull

The FortiGate Security Scanner (fort.py and fortnew.py, version string 2025-12-08) sprays the FortiGate REST API with combined wordlists (sample usernames admin, fortinet, fgtsecure and sysadmin), and when the device answers with a lockout it parks the host for exactly 60 seconds, matching FortiGate’s default admin lockout, then puts it back in a retry queue. With the --parse-configs flag, a successful login is followed by a configuration download and offline decryption of stored secrets with the default FortiOS key (CVE-2019-6693), which yields LDAP and Active Directory bind credentials and admin and local-user passwords. The detection logic is a stateful rule on FortiGate system event logs: for a single source address, count admin login failures and lockout events, and fire when failures resume within roughly 60 to 75 seconds of each lockout over several cycles and the same source then logs a successful REST API admin login followed by a configuration backup or download event within the hour.

Use FortiGate system event logs (admin login failed, admin lockout, admin login successful, and the configuration backup or system config download events) forwarded to a SIEM that can hold state per source. Back-test over 90 days and further if retention allows, since compromises ran from February to June 2026. Scope to every FortiGate with an internet-reachable management or REST API interface. Raw failure counts are useless because every exposed FortiGate is sprayed daily; the lockout-retry cadence and the success-then-backup sequence are what separate k0t’s tool from noise. Raising the lockout duration and threshold, as Group-IB recommends, breaks the tool’s retry assumption. Any successful login in this pattern means the config should be treated as disclosed: rotate the LDAP and AD bind account, every admin and local-user password and any VPN pre-shared keys, enable private-data-encryption with an operator-defined key, and hunt the bind account’s use in Active Directory. The logic generalizes to any credential-stuffing tool that respects lockout timers.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1110.003 (Brute Force: Password Spraying) (mapping per source article); Collection → T1602.002 (Data from Configuration Repository: Network Device Configuration Dump) (mapping per source article)

Sources: “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”, Group-IB, Oct. 21, 2026, https://www.group-ib.com/blog/stray-cat-network-edge/ (source article)

Edge-Sourced Session to Kerberoast, AD CS Relay and Rclone Exfiltration

After landing through a VPN session or with credentials recovered from a firewall config, k0t runs NetExec and SoftPerfect enumeration, requests service tickets for every SPN account with Impacket GetUserSPNs, sprays domain controllers with Kerbrute, coerces domain-controller authentication with PetitPotam (using the -pipe all option) into an NTLM relay to AD CS to obtain a certificate, uses noPac (CVE-2021-42278 and CVE-2021-42287) to reach domain admin, dumps LSASS with Mimikatz and secrets with secretsdump, and in deeper intrusions copies data out with Rclone to Wasabi S3 buckets and MEGA. The detection logic is a correlation keyed on source address: when an address from the VPN client pool or an edge appliance’s own interface generates, within a few hours, a burst of Kerberos service-ticket requests (Event 4769) with RC4 encryption across many SPNs, a domain-controller machine-account authentication to a non-DC host followed by a certificate enrollment for that machine account on the AD CS server, a computer account rename to a name without a trailing $ (Event 4742 or 4781, the noPac pattern), or a sudden spread of SMB logons, and then any host it touched runs rclone.exe or opens large outbound transfers to Wasabi or MEGA endpoints.

Use domain-controller security logs (4768, 4769, 4742, 4781, 4624), AD CS issuance logs (4886, 4887), VPN session logs to map assigned addresses to users, EDR process and network events, and proxy logs. Back-test over 90 days and run continuously. Scope to the VPN address pools and edge-appliance management addresses as sources, which keeps volume low. Individual pieces are noisy (vulnerability scanners request service tickets, backups go to cloud storage), so require at least two stages from the same edge-sourced address, and allowlist named scanners by account and host. Blocking rclone by file name alone is the wrong control because it is a single renamable binary; detect its command-line flags and destinations instead, and restrict uploads to unsanctioned cloud storage at the proxy. Patching noPac, enabling Extended Protection for Authentication on AD CS web enrollment and blocking EFS RPC coercion remove three steps of the chain. Any two-stage hit should go to incident response immediately, since by the time Rclone runs an access broker may already have sold the network. The chain generalizes to most hands-on-keyboard ransomware precursors.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting) (mapping per source article), T1187 (Forced Authentication) (mapping per source article); Privilege Escalation → T1068 (Exploitation for Privilege Escalation) (mapping per source article); Exfiltration → T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage) (mapping per source article)

Sources: “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”, Group-IB, Oct. 21, 2026, https://www.group-ib.com/blog/stray-cat-network-edge/ (source article)

Hash Appendix

No published YARA, Sigma or KQL rules: Group-IB gives detection and hunting guidance in prose only.

k0t tooling (unattributed file set)

All MD5, SHA-1 and SHA-256 values come from the source article. Group-IB lists seven of each but does not say which file each hash belongs to or whether the three lists are in the same order, so each is annotated by its position in the source’s list; the named artifacts in the report are fort.py, fortnew.py, exploit_2026_0257.py, clear-thinking_61.92.4_INSTALL.exe and 1.exe. OTX and VirusTotal were not queried, because no hash type was missing. Some of these files may be legitimate open-source tools (MeshAgent, Rclone, Impacket builds); blocking those hashes alone would not stop a fresh copy, so pair them with the behavior leads above.

MD5s

5318f29ef434341d989d543b14fd2a48  # k0t tool set, source MD5 #1 (file not named by source)
20dc8f1b8a313336c14e03bcb71ff6c8  # k0t tool set, source MD5 #2 (file not named by source)
032473db4d66748eab524effe57a661d  # k0t tool set, source MD5 #3 (file not named by source)
13367fbba4344de87de418ab17de76f0  # k0t tool set, source MD5 #4 (file not named by source)
197f2621c80da7974c56d2ff1921e994  # k0t tool set, source MD5 #5 (file not named by source)
6f5d18157425aa9697913ae1310f588f  # k0t tool set, source MD5 #6 (file not named by source)
0dc1af7cfd336a7f075228defc730082  # k0t tool set, source MD5 #7 (file not named by source)

SHA1s

6546801898d0b32f5050f49c5302f0366d630cc9  # k0t tool set, source SHA-1 #1 (file not named by source)
e2c96e603323d8fc7c08678b793d56554faa6914  # k0t tool set, source SHA-1 #2 (file not named by source)
b686a811ad89671fbdb448d65f79488d2e562265  # k0t tool set, source SHA-1 #3 (file not named by source)
f05daaf66b200672d679a5ced8b67d4b48a4906e  # k0t tool set, source SHA-1 #4 (file not named by source)
e47a2b7ca6a8c009962871dbb667d128ad6b6162  # k0t tool set, source SHA-1 #5 (file not named by source)
bfd864ec0e6bd912f932e4f3ed80687736ee16e8  # k0t tool set, source SHA-1 #6 (file not named by source)
b39cf70a0194d32e00d7812c29ae1d6add77b823  # k0t tool set, source SHA-1 #7 (file not named by source)

SHA256s

158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a  # k0t tool set, source SHA-256 #1 (file not named by source)
1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d  # k0t tool set, source SHA-256 #2 (file not named by source)
4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d  # k0t tool set, source SHA-256 #3 (file not named by source)
552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21  # k0t tool set, source SHA-256 #4 (file not named by source)
f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e  # k0t tool set, source SHA-256 #5 (file not named by source)
39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e  # k0t tool set, source SHA-256 #6 (file not named by source)
808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c  # k0t tool set, source SHA-256 #7 (file not named by source)

References Appendix

• “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”, Group-IB (Tsai Shun Ling, Nikolay Kichatov; with NyxLab), Oct. 21, 2026, https://www.group-ib.com/blog/stray-cat-network-edge/ (source article; actor profile, tooling, exploit mechanics, infrastructure, hashes, ATT&CK mapping, hunting guidance)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/