Vulnerabilities · 6h ago
Group-IB and NyxLab say k0t targeted exposed FortiGate, FortiWeb and GlobalProtect devices in a campaign that exposed more than 70,000 credentials. The investigation reports victims worldwide and activity from February to June 2026.
The operators either exploited known flaws—including a path traversal in FortiWeb and an authentication bypass in Palo Alto software—or guessed common passwords. They then used VPN connections and remote-access tools to maintain entry, and exfiltrated data. So the initial break-in could leave behind access and stolen information, not just compromised credentials.
The campaign overlaps in time with FortiBleed, but researchers say the credential and LDAP data may be a separate dataset or tied to only some operators. For organizations investigating exposed edge devices, fixing an entry flaw alone may not establish whether persistent access or data theft occurred—or which activity the recovered credentials belong to.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4… EPSS 92% (100th percentile).
CISA federal remediation date Nov 21 · date passed
Known exploited · CISA KEV
EPSS 97% (100th percentile).
CISA federal remediation date Jun 1 · date passed
1 source covering this story
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.
Vendor digest: Palo Alto Networks
Part of the PlainSec briefing for 2026-10-23