k0t Walks In Through Fortinet and GlobalProtect, Leaves With 70,000 Logins
Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.