k0t Mass-Exploits Fortinet and Palo Alto Edge Devices, Exposing 70,000+ Credentials; Links to Qilin and The Gentlemen
Group-IB and NyxLab disclosed a large-scale campaign by the cybercriminal actor k0t (aliases CryptoFeel, Member19, QazWsxShop, first seen October 22, 2025) against exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect. The actor is assessed to be an initial access broker or affiliate tied to the Q…