Hackers Breach Enterprise Firewalls and VPNs, Exposing More Than 70,000 Credentials Worldwide
Cybersecurity researchers have uncovered a large-scale intrusion campaign targeting enterprise firewalls and VPN gateways, exposing more than 70,000 credentials and creating opportunities for ransomware operators to infiltrate corporate networks.
The campaign, attributed to a threat actor known as k0t, involves the exploitation of vulnerabilities in Fortinet and Palo Alto Networks security products, password attacks against exposed management interfaces, and the deployment of remote access tools to maintain control over compromised systems.
A joint investigation published by Group-IB and NyxLab on October 21, 2026, revealed that the attackers had obtained access to organizations across multiple industries and geographic regions. In several cases, the intrusions progressed beyond the initial network device, allowing operators to collect additional credentials, establish persistence, and exfiltrate information.
Researchers also identified overlaps between affected organizations and victims subsequently named by the Qilin and The Gentlemen ransomware groups. Although these connections suggest a possible relationship with ransomware operations, investigators have not confirmed whether k0t operates directly as an affiliate, an initial access broker, or part of a broader criminal network.
The findings highlight a persistent enterprise security problem: devices deployed to protect corporate networks can become highly valuable entry points when they are exposed to the internet, inadequately configured, or left vulnerable to known exploits.
A Global Campaign Built Around Exposed Network Devices
The threat actor k0t, also associated with the aliases CryptoFeel, Member19, and QazWsxShop, has been observed in cybercriminal communities since October 2025.
Rather than focusing exclusively on specific organizations, the operator appears to identify targets through large-scale internet reconnaissance. Public scanning services such as FOFA and ZoomEye allow attackers to discover exposed network appliances, identify their products, and assemble lists of systems that may be vulnerable.
This approach makes the campaign largely opportunistic. Organizations become potential targets because their security devices are discoverable and appear susceptible to exploitation, rather than necessarily because of their industry or commercial importance.
Group-IB and NyxLab identified victims across Asia-Pacific, Latin America, Europe, and the Middle East and North Africa. Approximately 38% of the observed victim distribution was associated with Asia-Pacific, followed by 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa.
These figures reflect the researchers' available dataset, not a complete measurement of every affected organization worldwide. The geographical distribution may also reflect differences in internet exposure and device configuration rather than deliberate regional targeting.
A substantial portion of the observed Fortinet compromises occurred between February and June 2026, overlapping with activity associated with the previously reported FortiBleed credential-harvesting campaign.
However, the researchers found little overlap between the credential datasets associated with the two operations, suggesting that the newly identified activity may represent a separate group of operators or a distinct access campaign.
Fortinet and Palo Alto Vulnerabilities Provide Initial Access
The attackers relied on a combination of vulnerability exploitation and credential attacks to compromise network security appliances.
One of the primary targets was CVE-2025-64446, a path traversal vulnerability affecting Fortinet FortiWeb. The flaw can allow unauthenticated attackers to perform unauthorized administrative operations under vulnerable conditions.
Researchers recovered a custom Python-based tool called FortiGate Security Scanner, which was designed to process large lists of network devices and automatically attempt exploitation.
When targeting vulnerable FortiWeb systems, the tool attempted to abuse the flaw to create an unauthorized administrator account. If exploitation was unsuccessful, it could fall back to password guessing against exposed Fortinet management interfaces.
The tool also included functionality for downloading appliance configurations after obtaining access. Those configurations can contain valuable information about authentication systems, network topology, and credentials used to connect with enterprise services.
The investigation identified attempts to recover stored secrets, including LDAP and Active Directory credentials, from compromised devices.
A second attack path involved CVE-2026-0257, an authentication bypass vulnerability affecting certain Palo Alto Networks PAN-OS and Prisma Access configurations using GlobalProtect.
The vulnerability involves weaknesses in the handling of authentication-override cookies. Under specific conditions, an attacker can exploit the issue to establish a VPN session without completing the expected authentication process.
The researchers identified another Python script specifically designed to investigate this vulnerability and connect to susceptible GlobalProtect gateways.
Once a connection was established, the attackers could use OpenConnect, a legitimate VPN client, to interact with the victim's internal network.
The campaign demonstrates why perimeter appliances are particularly attractive targets. A successful compromise may give an attacker access to internal resources that are otherwise protected from direct internet exposure.
More Than 70,000 Credentials Exposed
One of the investigation's most significant findings was the discovery of more than 70,000 exposed credentials associated with network devices, LDAP records, and other compromised authentication data.
These credentials represent a substantial risk because they may provide access beyond the initially compromised firewall or VPN gateway.
Enterprise security appliances frequently integrate with centralized authentication systems such as Active Directory and LDAP. Depending on their configuration, they may store service account credentials or other secrets needed to communicate with internal infrastructure.
If attackers recover those credentials, they may be able to authenticate to additional systems without exploiting another software vulnerability.
This can transform an isolated appliance compromise into a broader identity-based intrusion.
After gaining access, the operators used tools such as NetExec, Impacket, Kerbrute, Mimikatz, and SoftPerfect to investigate internal networks and identify opportunities for further compromise.
Observed activity included enumerating SMB services, identifying privileged accounts, extracting authentication material, and attempting to escalate privileges within Windows domains.
Some techniques targeted domain controllers and authentication services, potentially allowing attackers to expand their access to sensitive systems.
The reported 70,000 credentials should not be interpreted as 70,000 independently compromised organizations. Multiple credentials may belong to the same company or device, and the dataset includes different categories of authentication material.
Nevertheless, the volume demonstrates how compromising network infrastructure can expose a large collection of valuable secrets.
Attackers Use Legitimate Remote Management Tools for Persistence
Once inside victim environments, the operators frequently relied on legitimate remote management software rather than deploying exclusively custom malware.
Researchers observed the use of MeshCentral, Atera, Teramind, AnyDesk, and other administration tools to maintain access to compromised systems.
These applications are commonly used by IT teams for remote support and infrastructure management. Their legitimate functionality makes them useful to attackers seeking reliable remote control while blending into environments where similar software may already be present.
The campaign also involved AdaptixC2, an open-source command-and-control framework capable of supporting remote command execution, file transfers, tunneling, and additional post-exploitation operations.
Group-IB and NyxLab identified a MeshCentral management server containing 28 active device groups and 84 compromised devices communicating with the infrastructure at the time of analysis.
The researchers also observed evidence of approximately 100 additional device groups that had previously been removed.
These findings suggest that the operation involved multiple compromised environments and potentially several cooperating operators.
For data exfiltration, the attackers used Rclone, a legitimate file synchronization utility, to transfer stolen information to cloud storage services, including Wasabi S3 and MEGA.
This combination of authorized software and malicious activity complicates detection. A remote management agent, VPN connection, or cloud synchronization process may appear legitimate when examined in isolation.
Security teams therefore need to evaluate whether these tools were deployed by approved administrators, whether their activity matches expected business operations, and whether they communicate with unfamiliar infrastructure.
Possible Connections to Ransomware Operations
The researchers found that several organizations affected by the campaign were subsequently listed on leak sites associated with the Qilin and The Gentlemen ransomware groups.
This overlap raises the possibility that k0t and associated operators provide compromised network access to ransomware affiliates.
Initial access brokers specialize in obtaining access to corporate systems and selling or transferring that access to other criminal groups. Ransomware operators can then use the foothold to steal data, deploy encryption malware, or extort victims.
The campaign's methods are consistent with that business model. The operators gathered credentials, established persistent access, and appeared to organize compromised systems in ways that could support additional intrusions.
However, the researchers emphasized that the precise relationship between k0t and the ransomware groups remains unconfirmed.
The fact that an organization appears in both datasets does not establish that k0t directly conducted a ransomware attack against it.
Different criminal operators may exploit the same vulnerable infrastructure, purchase access through underground markets, or compromise the same organization independently.
Even without definitive attribution, the overlap illustrates the potential consequences of failing to secure network-edge devices. An initial compromise may become the starting point for a much more damaging incident involving credential theft, data exfiltration, and ransomware.
What Organizations Should Do to Reduce Exposure
The campaign reinforces the need to treat internet-facing firewalls and VPN appliances as high-priority security assets.
Organizations should first identify all externally accessible network devices and verify that they are running supported, patched software. Particular attention should be given to FortiWeb deployments affected by CVE-2025-64446 and GlobalProtect configurations potentially exposed to CVE-2026-0257.
Administrative interfaces should not be unnecessarily exposed to the public internet. Where remote management is required, access should be restricted through appropriate network controls and trusted administrative paths.
Security teams should also review authentication logs for suspicious administrator activity, unexpected VPN sessions, and repeated failed login attempts.
Because the campaign involved credential harvesting, remediation may require more than installing security updates. Organizations that identify evidence of compromise should investigate whether stored credentials were accessed and rotate affected secrets.
Additional priorities include reviewing newly created administrator accounts, examining remote management software installations, and investigating unauthorized access to Active Directory resources.
Monitoring should also cover unusual outbound transfers to cloud storage services, particularly when synchronization tools appear on systems where they are not normally used.
If compromise is confirmed, administrators should assess the integrity of affected appliances and consider rebuilding them from trusted firmware or configurations rather than assuming that removing a suspicious account eliminates persistence.
The researchers' findings also support broader security measures, including network segmentation, privileged access management, multifactor authentication where supported, and continuous monitoring of exposed infrastructure.
Why This Campaign Matters
The k0t campaign demonstrates that attackers do not always need sophisticated zero-day vulnerabilities to penetrate enterprise networks.
By combining known security flaws, weak credentials, automated scanning, and legitimate administrative tools, the operators were able to compromise exposed infrastructure and expand their access into corporate environments.
The discovery of more than 70,000 credentials illustrates how quickly the consequences of a network-edge compromise can extend beyond a single device.
It also highlights the importance of understanding the relationship between network security and identity security. A compromised firewall may expose authentication material that provides access to servers, applications, and domain infrastructure long after the original vulnerability has been patched.
The possible connections to ransomware groups make the findings especially concerning, although the available evidence does not establish the exact criminal relationships involved.
The central lesson is that firewalls and VPN gateways must be protected with the same rigor as the critical systems behind them. When attackers compromise the infrastructure responsible for securing network access, they may gain both an entry point and the credentials needed to move deeper into an organization.