Global Cybersecurity Threat: Large-Scale Campaign Targets Network Devices
In a troubling development for global cybersecurity, researchers have revealed details of an extensive cyber attack campaign exploiting vulnerabilities of exposed network edge devices, notably Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. This alarming insight emerges from a joint investigation conducted by cybersecurity firms Group-IB and NyxLab.
The findings indicate that the malicious actors behind this campaign have successfully gained access to a multitude of organizations across the globe. In addition to initial breaches, there have been attempts to further compromise certain victims, leading to ongoing remote access and the potential for data exfiltration. Such action signals a troubling shift in the tactics of cybercriminals, as attackers continue evolving to penetrate defenses in a more insidious manner.
The campaign has been attributed to a threat actor identified as k0t, who is also known by aliases including CryptoFeel, Member19, and QazWsxShop. The first known activities of this cybercriminal were recorded on October 22, 2025. Analysts have determined that k0t likely operates as either an initial access broker or an affiliate within a broader network of ransomware groups, notably Qilin and The Gentlemen.
A closer examination of k0t’s operations in the dark web indicates a deliberate strategy focused on acquiring vulnerability exploit codes and premium accounts for metadata search engines such as FOFA and ZoomEye. This signifies a calculated approach, suggesting that the actor aims to facilitate access to susceptible systems through purchasing tools rather than developing them independently.
The range of victims impacted by this campaign is vast, with organizations across various sectors falling prey to these attacks. Notably, a significant number of compromises were reported between February and June 2026. This period coincides with another credential harvesting campaign dubbed FortiBleed, highlighting an interconnected web of cyber threats targeting organizations.
Statistical analysis of the victim demographics reveals a concerning concentration of breaches. Approximately 38% of affected entities are located in the Asia Pacific region, followed by 31.9% in Latin America. Europe accounts for 15.8% of victims, while the Middle East and North Africa constitute 12.7%. This geographical distribution indicates a global risk landscape that organizations must navigate carefully.
The attack sequence employed by k0t is multifaceted. Initial reconnaissance is conducted through public scanning tools like FOFA and ZoomEye, which allow criminals to identify internet-facing VPNs and firewall appliances. Potential targets are filtered based on product and classified as vulnerable edge devices, thus compiling a target list for exploitation.
Key strategies for exploitation involve leveraging known vulnerabilities, such as the path traversal flaw in FortiWeb (CVE-2025-64446) and an authentication bypass flaw in Palo Alto Networks PAN-OS (CVE-2026-0257). Utilizing tailored Python scripts named “fortnew.py” and “exploit_2026_0257.py,” as well as brute-force techniques to exploit common username and password combinations, these actors secure initial access to their targets.
Once a foothold is established, k0t employs an OpenConnect VPN for persistent access. The post-exploitation phase escalates in seriousness as attackers pursue additional credential theft, leveraging techniques to enumerate Active Directory, Server Message Block (SMB), and installed antivirus solutions. To maintain a long-term presence, they utilize legitimate remote access tools, including MeshCentral Agent and Atera, alongside open-source frameworks like AdaptixC2.
Data exfiltration is performed using tools such as Rclone, facilitating the transfer of harvested data into Wasabi S3 buckets and MEGA cloud drives. Intriguingly, the attacks demonstrate the use of legitimate administrative and penetration testing utilities, allowing k0t to burrow deeper into victims’ corporate environments without raising undue suspicion.
Researchers from Group-IB and NyxLab have noted, “k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations.” This indicates a preference for geographical targeting, with a primary focus on the United States and Canada, followed by European countries and select Asia-Pacific markets.
What is particularly concerning is the linkage of k0t to renowned ransomware groups. Several victims of this recent campaign have been identified on the data leak sites of Qilin and The Gentlemen, though the specifics of this relationship remain ambiguous. Furthermore, the researchers highlighted a “negligible overlap” between the compromised data connected to this campaign and the previously noted FortBleed activities. Over 70,000 exposed credentials and LDAP dumps have been identified, raising significant alarm regarding the scale and severity of the vulnerabilities.
In conclusion, the findings from Group-IB and NyxLab serve as a clarion call for organizations worldwide. The breadth and sophistication of this cyber threat compel cybersecurity professionals to assess and address the vulnerabilities highlighted in their investigation. The ongoing risk posed by actors like k0t necessitates a proactive stance—one that emphasizes vigilance and preparedness against a constantly evolving cyber threat landscape. Organizations must prioritize robust security measures to safeguard their networks from similar attacks in the future.