k0t campaign exposes 70,000+ credentials via FortiGate and GlobalProtect

Group-IB and NyxLab disclosed a year-long campaign by actor k0t targeting internet-facing Fortinet and Palo Alto Networks appliances. Using CVE-2025-64446, CVE-2026-0257 and brute force, the actor exposed over 70,000 credentials including LDAP dumps, with some victims later listed on Qilin and The Gentlemen leak sites.

• Over 70,000 network device and LDAP credentials exposed in a year
• Exploited CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS
• 38% of victims in APAC, 31.9% in Latin America, 15.8% in Europe
• Data exfiltrated via Rclone to Wasabi and MEGA; persistence via AnyDesk and AdaptixC2