Group-IB Threat Intelligence and NyxLab published a joint investigation on 21 October 2026 into a large-scale campaign against internet-facing network edge devices by a threat actor known as k0t. The researchers say the operators enumerate exposed VPN and firewall appliances in bulk with attack-surface search engines such as FOFA and ZoomEye, then gain access by exploiting CVE-2025-64446 (a FortiWeb path traversal) with a custom script, CVE-2026-0257 (a GlobalProtect authentication bypass on vulnerable PAN-OS configurations) with a separate tool, or by brute-forcing exposed Fortinet devices.

On FortiGate they download the configuration and decrypt its stored secrets offline with the default FortiOS AES key (CVE-2019-6693), recovering LDAP/Active Directory bind, administrator and local-user credentials. They then connect over OpenConnect VPN, move toward domain-administrator control with tools including NetExec, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz, persist with MeshCentral/MeshAgent, Atera, AnyDesk and AdaptixC2, and exfiltrate with Rclone to Wasabi S3 and MEGA.

Group-IB and NyxLab say they found more than 70,000 exposed credentials associated with network devices, LDAP dumps and the like that were not linked to any other threat actor, including the FortiBleed cluster; that many FortiGate compromises date from February to June 2026; that Asia-Pacific accounts for 37.6% of unique victim domains, which they say may reflect where exposed devices are rather than deliberate targeting; and that victims overlap with those of ransomware groups including Qilin and The Gentlemen, though any relationship is still unconfirmed.

Primary: Group-IB blog. Updated 23 Oct 2026: The Hacker News reported the research. (source: The Hacker News)