k0t-Linked Campaign Targets Fortinet and GlobalProtect Systems to Steal Credentials

Group-IB and NyxLab reported a campaign linked to the operator k0t targeting internet-facing Fortinet FortiGate and FortiWeb devices and Palo Alto Networks GlobalProtect systems to steal credentials and maintain access to corporate networks. Attackers attempted to exploit CVE-2025-64446 in FortiWeb and CVE-2026-0257 in GlobalProtect, while trying common username-and-password combinations against FortiGate devices. Researchers identified more than 70,000 exposed credentials and related records, but did not establish that every listed credential enabled a successful compromise.

After gaining access, attackers extracted configuration secrets and used credential-access and remote-management tools, with Rclone used for data exfiltration in some cases. Researchers identified 84 compromised devices associated with a MeshCentral server. Some victims later appeared on ransomware leak sites, although a direct affiliation between k0t and those ransomware groups remains unconfirmed. Organizations should apply vendor fixes, restrict administrative access, investigate unexpected accounts and configuration exports, and rotate potentially exposed credentials.