k0t Walks In Through Fortinet and GlobalProtect, Leaves With 70,000 Logins
Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.
A threat actor called k0t has spent much of 2026 breaking into companies through their firewalls and VPN portals and then working toward domain admin, according to a joint investigation by Group-IB and NyxLab. The researchers say k0t doesn’t pick victims so much as scan for exposed Fortinet and Palo Alto GlobalProtect devices and walk through whichever ones open, and that most compromises happened between February and June. As The Hacker News notes, the haul runs to more than 70,000 stolen credentials. They assess k0t is most likely an initial access broker, and note victim overlap with the Qilin and The Gentlemen leak sites without confirming any affiliation.
For defenders
Way in: A custom Python scanner hits FortiWeb with CVE-2025-64446 (path traversal, CVSS 9.8) to create a rogue local admin, and brute-forces FortiGate REST APIs, which that bug doesn’t affect. With the right flag it pulls FortiGate configs and decrypts stored LDAP and admin secrets using the default FortiOS key, the old CVE-2019-6693 (CVSS 6.5). A second tool forges GlobalProtect authentication-override cookies for CVE-2026-0257 (CVSS 4.0 7.8, EPSS about 95%), the same bug ransomware crews were already abusing, then connects with OpenConnect. All three are in CISA’s KEV catalog, and patches exist for all of them. That’s T1190 (Exploit Public-Facing Application), T1110 (Brute Force) and T1133 (External Remote Services).
Inside: NetExec, Impacket (Kerberoasting and secretsdump), Kerbrute spraying, Mimikatz, PetitPotam relayed to AD CS, and noPac for CVE-2021-42278 and CVE-2021-42287 (both CVSS 7.5, on KEV since 2022). Relevant techniques: T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting), T1003.001 (OS Credential Dumping: LSASS Memory), T1187 (Forced Authentication) and T1068 (Exploitation for Privilege Escalation).
Staying in: MeshCentral (one server held 84 compromised devices), AdaptixC2, Atera, AnyDesk, ngrok and a Nezha dashboard, matching T1219 (Remote Access Tools). In deeper intrusions, Rclone shipped data to Wasabi and MEGA, T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage).
mesh[.]buttruyen[.]com
agent[.]afahimsa[.]top
sthyjk[.]com
radesashar[.]com
62[.]60[.]131[.]43
64[.]94[.]85[.]14
168[.]100[.]11[.]99
193[.]149[.]187[.]81What it means for you
If your business has a Fortinet or Palo Alto box at the edge of its network, this is the kind of attacker that finds it without ever hearing your name. Old bugs and guessable admin passwords are enough. Once inside, the goal is usually to hand or sell the access to ransomware crews. If you don’t run these products, there’s nothing to do here.
Do this now
- Patch FortiWeb, FortiOS and PAN-OS, and take admin consoles off the internet entirely.
- On FortiGate, turn on
private-data-encryptionwith your own key. If a config may have leaked, rotate every credential it contains, especially LDAP bind accounts. - Patch domain controllers for noPac, enforce MFA on VPN logins, and hunt for MeshCentral, AdaptixC2, ngrok and unexpected Rclone.
CVE at a glance
- CVSS
- 9.8 Critical (v3.1)
- EPSS
- 91.1% chance of exploitation in the next 30 days (higher than 99.8% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Nov 14, 2025
- Public exploit
- Yes, reported in a Metasploit module, Exploit-DB, a Nuclei template and 13 GitHub repositories
- CVSS
- 6.5 Medium (v3.1)
- EPSS
- 6.6% chance of exploitation in the next 30 days (higher than 93.8% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Jun 25, 2025; used by ransomware
- Public exploit
- Yes, reported in 4 GitHub repositories
- CVSS
- 7.8 High (v4.0)
- EPSS
- 95% chance of exploitation in the next 30 days (higher than 99.8% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since May 29, 2026; used by ransomware
- Public exploit
- Yes, reported in a Nuclei template and 7 GitHub repositories
- CVSS
- 7.5 High (v3.1)
- EPSS
- 73.3% chance of exploitation in the next 30 days (higher than 99.4% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Apr 11, 2022; used by ransomware
- Public exploit
- Yes, reported in 6 GitHub repositories
- CVSS
- 7.5 High (v3.1)
- EPSS
- 77.2% chance of exploitation in the next 30 days (higher than 99.5% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Apr 11, 2022; used by ransomware
- Public exploit
- Yes, reported in 7 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.