k0t operator mass-exploits FortiGate, FortiWeb and GlobalProtect edge devices, exposing 70,000+ credentials; links to Qilin and The Gentlemen
Group-IB research, disclosed together with NyxLab (thehackernews.com), describes a large-scale credential-theft and access campaign by an operator tracked as k0t (aliases CryptoFeel, Member19, QazWsxShop, first seen October 22, 2025 per thehackernews.com). It targets exposed network edge devices: Fortinet FortiGate, FortiWeb and Palo Alto…