k0t

k0t, also known as CryptoFeel, Member19, and QazWsxShop, is a threat actor associated with large-scale compromises of internet-facing firewalls and VPN appliances. Its operations affect organizations across multiple industries and regions, with target selection emphasizing exposed products rather than particular sectors. The actor has expressed geographic priorities beginning with the United States and Canada. Its country of origin and any state affiliation are not established. The actor uses FOFA, ZoomEye, and bulk target lists to discover exposed Fortinet FortiGate and FortiWeb appliances and Palo Alto Networks GlobalProtect systems. Initial-access techniques include weak-password brute-forcing against FortiGate, exploitation attempts against FortiWeb through CVE-2025-64446, and GlobalProtect authentication bypass through CVE-2026-0257. After obtaining appliance access, operators export configurations and recover stored administrator, LDAP, and Active Directory credentials, including by decrypting secrets protected with a known default FortiOS encryption key. Forged authentication cookies and OpenConnect support unauthorized VPN access. Post-compromise activity includes network and Active Directory enumeration, credential dumping, remote command execution, lateral movement, and domain-administrator privilege-escalation attempts. Tooling includes NetExec, Impacket, Mimikatz, Kerbrute, noPac, and PetitPotam. Persistent remote access is maintained through MeshCentral, Atera, AnyDesk, Teramind, and AdaptixC2. Operators use Rclone to exfiltrate data to Wasabi S3 and MEGA cloud storage. The associated campaign exposed more than 70,000 credentials and related records, although that total does not represent an equivalent number of confirmed compromises. Some affected organizations subsequently appeared on Qilin and The Gentlemen ransomware leak sites; this overlap does not establish that k0t directly deployed ransomware or belonged to either operation.