How the k0t campaign stole more than 70,000 credentials through FortiGate, FortiWeb and GlobalProtect

On 21 October 2026 Group-IB and the firm NyxLab published a joint investigation into a campaign against perimeter devices in which the threat actor k0t is, according to the researchers, likely one of the main operators. The report describes a collaborative operation more than the work of a single actor. The campaign amassed more than 70,000 credentials and related data, including LDAP directory dumps, through FortiGate firewalls, FortiWeb web application firewalls (WAF) and Palo Alto Networks GlobalProtect VPN gateways.

On many FortiGate units the attacker got in with weak or default passwords on management interfaces exposed to the internet, without exploiting any new vulnerability. With that access it obtained the device configuration, which holds the accounts the firewall uses to query the company's Active Directory. Group-IB assesses that the operators are likely acting as initial access brokers (IABs), and several victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups, although that link is unconfirmed.

How far did the k0t campaign reach?

The k0t campaign has hit organisations worldwide and across a wide range of sectors, with many FortiGate compromises dated between February and June 2026, according to Group-IB and NyxLab. The operator finds exposed devices with attack-surface search engines and attacks them at scale.

The 70,000 figure refers to credentials and related data, not to breached companies. Group-IB does not publish the number of victims and regards its count of unique domains as a lower bound. On the attacker's MeshCentral server, a legitimate remote administration tool, it found 28 active device groups containing 84 compromised devices, plus traces of another 100 groups that had since been removed.

Asia-Pacific accounts for 37.6% of the domains identified and Latin America is the other region with a large share, although the report warns that this distribution is not evidence of deliberate regional targeting. On a forum, the operator named the United States and Canada as priorities, followed by European countries and selected Asia-Pacific markets.

This figure should not be confused with FortiBleed, another FortiGate campaign the FBI and the US Secret Service warned about in early October, according to The Hacker News. Group-IB assesses with moderate confidence that k0t's activity is associated with FortiBleed, but the overlap in compromised data is negligible and does not show that the same operators controlled both datasets.

Which weaknesses did k0t exploit in Fortinet and Palo Alto devices?

The campaign exploited CVE-2025-64446 on FortiWeb and CVE-2026-0257 on GlobalProtect, and on FortiGate combined weak passwords with the CVE-2019-6693 weakness. Fortinet disclosed the FortiWeb flaw on 14 November 2025 in advisory FG-IR-25-910, when it was already being exploited. CISA added it to its KEV catalogue of exploited vulnerabilities the same day. After upgrading, Fortinet advises checking whether unauthorised administrators have been created.

FortiGate units are not vulnerable to the FortiWeb flaw. Against them, the campaign used a brute-force attack on the management REST API with common username and password combinations. When it succeeded, it downloaded the configuration and decrypted its secrets off the device, using the fixed default key in FortiOS, tracked as CVE-2019-6693 in advisory FG-IR-19-007. Upgrading does not fix that weakness, because the private data encryption that prevents it is off by default. CISA added it to its KEV catalogue in June 2025, with known use in ransomware campaigns.

On GlobalProtect, CVE-2026-0257 is an authentication bypass that Palo Alto Networks fixed on 13 May 2026. It affects portals and gateways with authentication override cookies enabled together with a specific certificate configuration, and also Prisma Access, which Palo Alto upgrades itself, according to its security advisory. CISA added it to the KEV catalogue on 29 May. Unit 42, Palo Alto's threat intelligence team, has observed attempted exploitation by ransomware operators, including Qilin and INC.

Why is a firewall configuration so valuable?

A firewall configuration is so valuable because a device integrated with Active Directory stores, in reversibly encrypted form, the password of its LDAP account and those of local VPN users. It also holds other secrets, such as IPsec pre-shared keys or RADIUS secrets. Administrator passwords are stored as hashes. If those secrets can be decrypted, a single stolen configuration gives the attacker a first step inside the domain.

NyxLab stresses that an intrusion into a perimeter device should be treated as a potential compromise of corporate credentials. The report therefore recommends enabling FortiGate private data encryption and auditing the LDAP accounts used by perimeter devices, which should hold minimal permissions.

What did the operators do once inside?

Once inside, the operators enumerated Active Directory, harvested credentials and tried to escalate to domain administrator with dual-use tools such as NetExec, Impacket, Kerbrute or Mimikatz, according to Group-IB. The report records the use of noPac (CVE-2021-42278 and CVE-2021-42287) for that purpose.

They kept access through remote administration tools such as MeshCentral, Atera or AnyDesk, ngrok tunnels and AdaptixC2, an open-source command and control (C2) framework. They moved data out with Rclone to cloud storage services such as Wasabi and MEGA. Group-IB does not describe k0t deploying ransomware, and this pattern of access, credential theft and exfiltration is consistent with selling footholds, which is the researchers' hypothesis.

Is k0t connected to Qilin and The Gentlemen?

The link between k0t and these two ransomware groups is unconfirmed, although Group-IB has observed several of the campaign's victims later appearing on the leak sites of Qilin and The Gentlemen. Group-IB states that it has not been able to confirm any relationship between the operators and those groups, including any direct affiliation.

Both groups are among the most active of 2026. According to ReliaQuest, in the second quarter The Gentlemen posted 300 victims and Qilin 289. Arctic Wolf documented in July several Qilin intrusions that began with the exploitation of CVE-2026-0257 and assesses with moderate confidence that such intrusions are likely ongoing. Together with Unit 42's observations, this suggests perimeter devices are a common entry route for Qilin affiliates, whether they exploit the flaw themselves or buy the access.

Does the k0t campaign affect Spanish companies?

As of 28 October 2026 no Spanish victim of k0t has been reported, because the Group-IB report does not name Spain and the victim list is not public. The operator did list European countries among its priority targets, behind the United States and Canada.

Separately, Escudo Digital reported in January 2026 that Qilin had claimed a Spanish company on its leak site. The Castilla-La Mancha Digital Transformation Agency noted in its first-quarter report that the group exploits perimeter FortiGate firewalls and that in Spain and Europe it has mainly targeted manufacturing. No data links that victim to k0t.

Without a public victim list, the useful check for a Spanish company is whether its perimeter devices meet the conditions the campaign exploited.

Which perimeter measures come first?

The priorities are taking device management off the internet, removing default passwords, enabling MFA, patching FortiWeb and GlobalProtect and turning on FortiGate's private data encryption. Group-IB sets them out in its report, and Fortinet and Palo Alto Networks in their security advisories.

• The management console and API of firewalls, WAFs and VPN gateways should be reachable only from an internal management network or a trusted VPN, never from the internet.
• No administrator account should keep default or common passwords, and all should use multi-factor authentication (MFA) wherever the device supports it.
• FortiWeb should run a version fixed for CVE-2025-64446. Until it is upgraded, Fortinet advises disabling HTTP and HTTPS administration on internet-facing interfaces.
• On FortiGate, private data encryption (private-data-encryption) should be enabled. Check the impact on high-availability clusters, FortiManager and configuration backups first, because it only protects what is encrypted from that point on.
• Administrator accounts created without a documented request, configuration exports and changes to trusted hosts should be reviewed as possible signs of compromise.

Knowing which of the organisation's devices expose management to the internet requires a regular external inventory, which is the basis of an attack surface management service. Prioritising patches by active exploitation, as we explain in our analysis of vulnerability management and compromised credentials, puts these flaws near the top of the list.

How should FortiGate administration be protected?

On FortiGate, the REST API uses the same HTTPS service as the admin console, so HTTPS, SSH and HTTP should be removed from administrative access on WAN interfaces. Fortinet recommends combining two controls, namely trusted hosts on every administrator and API user and a local-in policy denying those services from the internet.

The default lockout after failed attempts lasts 60 seconds and should be lengthened, as Group-IB suggests, and the default admin account should be disabled or renamed. Local traffic logs, which show attempts against the admin plane, are disabled by default and should be turned on.

Before FortiOS 7.6.1 the organisation defines the private data encryption secret, and from 7.6.1 the device generates it. From 7.6.3 the feature is only available on models with a TPM. Configuration copies that already exist, in FortiManager, backup servers or support-ticket attachments, remain encrypted with the default secret and should be treated as exposed.

Why does MFA not protect against CVE-2026-0257?

MFA does not protect against CVE-2026-0257 because the flaw lies in the cookie that skips re-authentication. GlobalProtect portals and gateways also have to be reachable from the internet, so isolating management does not replace the fix either. Palo Alto says to upgrade all portals and gateways that generate or accept those cookies at the same time, since a partial upgrade causes compatibility failures.

If an upgrade is not yet possible, cookie-based authentication override should be disabled, or the cookies should use a new certificate dedicated to them and never used for another service. Hybrid Prisma Access deployments must also upgrade the organisation's own firewalls. Arctic Wolf also advises terminating active sessions after patching.

How can an intrusion like this be detected?

An intrusion like this shows up mainly in firewall, WAF and VPN logs, which should be sent to a SIEM because these devices usually sit outside EDR coverage. We examined that gap in EDR blind spots on network edge devices.

The SIEM should watch for administrator lockouts, REST API use, configuration downloads, new administrators and changes to trusted hosts, above all if they are opened to every source. For CVE-2026-0257, Unit 42 and Arctic Wolf point to GlobalProtect sessions from hosting-provider ranges and with generic or default machine names.

The most specific signal is the firewall's LDAP account logging on from a machine other than the firewall. Domain controllers record those logons, and an alert on that account authenticating from other addresses produces few false positives. Because the documented compromises go back to February 2026, a retrospective search needs perimeter logs from at least January, and from before November 2025 for FortiWeb. If logs were kept only on the device and do not cover that period, the absence of alerts does not rule out compromise.

Inside the network, the report recommends hunting for attack tooling aimed at Active Directory, unauthorised installations of remote administration software and unexpected transfers to Wasabi, MEGA or ngrok. An allowlist of approved remote access tools, with alerts on any other installation, catches both this campaign and whoever buys the access later.

Group-IB publishes indicators specific to this campaign, such as MeshCentral domains and addresses, AdaptixC2 servers and file hashes. Those from Unit 42 and Arctic Wolf relate to CVE-2026-0257 exploitation and Qilin intrusions, not to k0t. Because IP addresses change quickly, they should be combined with the behaviour-based hunting carried out by a threat hunting service or a managed SOC with visibility of the perimeter.

Why does patching the device not close the incident?

Updating the device fixes the vulnerability but does not invalidate credentials or configurations already stolen, and the FortiGate units hit by brute force had no flaw to patch. Group-IB recommends treating an exposed configuration as a credential disclosure and rotating every credential it contains.

Order matters, because rotating before the attacker's access to the device is closed lets the attacker read the new secrets again. If there are signs of compromise, the incident response procedure usually follows this sequence.

• Device and SIEM logs and a copy of the configuration are preserved before any upgrade or reboot.
• Device management is taken off the internet and active VPN and administrative sessions are terminated.
• Unauthorised administrators and trusted hosts are removed, patches are applied and private data encryption is enabled.
• Credentials in the configuration are rotated, starting with the LDAP bind account in the directory, then local users, RADIUS or TACACS+ secrets and IPsec pre-shared keys, coordinated with the peer at the other end of each tunnel.

Where there are signs of domain compromise, such as the noPac escalation Group-IB describes, Arctic Wolf advises assuming full domain compromise and resetting the krbtgt account twice, following Microsoft guidance. Internal network segmentation also limits what a VPN foothold can reach.

When must an intrusion like this be reported?

An intrusion like this must be notified to the Spanish data protection authority (AEPD) within 72 hours if it compromises personal data in a way that poses a risk to the people concerned. LDAP dumps usually contain such data, including employee names, email addresses and group memberships. Public sector bodies and their suppliers within the scope of Spain's National Security Framework (ENS) must also report significant incidents to CCN-CERT.

In the financial sector, DORA requires the incident to be classified and, if it is major, an initial notification to reach the supervisor within 4 hours of classification and no later than 24 hours after the entity becomes aware of it. Operators of essential services report to their reference CSIRT under Royal Decree-law 12/2018 while Spain completes the transposition of NIS2.

Sources and attribution: this analysis draws on the Group-IB and NyxLab investigation of 21 October 2026 and the Fortinet and Palo Alto Networks security advisories. It also uses the Unit 42 and Arctic Wolf analyses, ReliaQuest's second-quarter report and The Hacker News reporting on FortiBleed, with the information available on 28 October 2026. The link between k0t and Qilin and The Gentlemen is a victim overlap noted by the researchers, not a confirmed attribution. Mentioning vendors does not imply flaws beyond those they have published in their own advisories.

Notice: the recommendations are indicative and must be adapted to each environment and tested before use in production. Incident notification depends on each organisation's sector and the regulations that apply to it.