k0t operator mass-exploits FortiGate, FortiWeb and GlobalProtect edge devices, exposing 70,000+ credentials; links to Qilin and The Gentlemen
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:06; os links antigos trazem para cá.
Fontes: thehackernews.com ↗ gbhackers.com ↗
Group-IB research, disclosed together with NyxLab (thehackernews.com), describes a large-scale credential-theft and access campaign by an operator tracked as k0t (aliases CryptoFeel, Member19, QazWsxShop, first seen October 22, 2025 per thehackernews.com). It targets exposed network edge devices: Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect. More than 70,000 credentials tied to network-device records, LDAP dumps and other artifacts were identified. Most compromises occurred between February and June 2026, overlapping with the FortiBleed credential-harvesting campaign reported in June, though the data overlap was negligible. Thehackernews.com assesses k0t as an initial access broker or affiliate tied to the Qilin and The Gentlemen ransomware groups because many victims later appeared on their leak sites. Gbhackers.com says ransomware affiliation is unconfirmed. k0t picks targets by device type and exposure rather than by industry.
Entenda a falha
A vulnerabilidade
Three known flaws are used in the k0t campaign. CVE-2025-64446 is a relative path traversal in Fortinet FortiWeb. Per Fortinet, crafted HTTP or HTTPS requests give an unauthenticated attacker administrative command execution. k0t uses it to create an administrator account with unrestricted trusted-host access. CVE-2026-0257 is an authentication bypass in Palo Alto Networks PAN-OS and Prisma Access (GlobalProtect). Cookie forgery allows unauthorized VPN connections, but only on configurations with authentication override and certificate reuse. CVE-2019-6693 is the known default FortiOS AES key. It lets an attacker who has already authenticated to a FortiGate decrypt secrets in the downloaded configuration, such as LDAP bind credentials. The articles give no affected or fixed versions.
Como funciona
The operator builds lists of exposed VPN and firewall appliances with FOFA and ZoomEye, filtered by product. Against FortiWeb, a Python tool sends crafted requests that reach administrative functions without authentication, then creates an admin account and checks that the credentials work. FortiGate is not affected by that flaw, so the tool brute-forces the REST API and waits 60 seconds when a target blocks it. After login, an optional function downloads the configuration and decrypts the stored secrets with the default key. For GlobalProtect, a separate scanner forges an authentication-override cookie and obtains a VPN session, then OpenConnect sets up network access. From there the operators enumerate Active Directory and move deeper into the network.
Por que é vulnerável
The articles give limited root-cause detail. CVE-2025-64446 is classed as a relative path traversal, so request paths are not restricted to what the caller may reach, and administrative functions become reachable without authentication. CVE-2026-0257 is an authentication bypass in which the authentication-override cookie can be forged. It works only when authentication override and certificate reuse conditions are present. CVE-2019-6693 comes from FortiOS using a known default AES key to protect secrets in configuration, so anyone who obtains the config can decrypt them. The articles do not say what the vendor fixes change, beyond advising defenders to apply vendor fixes.
Como foi descoberta
The campaign was disclosed in a joint investigation by Group-IB and NyxLab, reported by gbhackers.com on October 22, 2026 and by The Hacker News on October 23. They attribute it to k0t (aliases CryptoFeel, Member19, QazWsxShop), first seen on October 22, 2025, based on investigation artifacts and the actor's dark web activity. Most compromises occurred between February and June 2026. The articles do not say who found the three CVEs or how they were reported to the vendors. They treat all three as known vulnerabilities exploited in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 24/10/2026 00:21.
2 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2025-64446. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
FortiWeb 8.0.2 - Remote Code Execution
This script targets the FortiWeb management interface over the network, with no credentials needed. It abuses a path-traversal flaw in the user-creation API to add a rogue administrator, which matches the authentication-bypass part of CVE-2025-64446 on unpatched builds. It then logs in and tries to turn the backup upload feature into a web shell for a root reverse shell. The RCE stage looks speculative, the file is unverified, and it has a coding error that would stop it running unmodified, so treat it as a rough proof of concept. Patch and keep the management interface off the internet.
-
Fortinet FortiWeb v8.0.1 - Auth Bypass
This file is a write-up, not an exploit. It claims CVE-2025-64446 is a path traversal in how FortiWeb's web interface normalizes request paths, letting an unauthenticated remote attacker reach administrative functions without user interaction, on versions 7.0 through 8.0.1. The payload is withheld and the reproduction is sent to a paid external page, so there is no code, proof of concept or exposure check, and Exploit-DB did not verify it. Defenders should patch to the fixed releases and keep management interfaces off the internet.
Detalhes técnicos
- Reconnaissance: target lists are built with FOFA, ZoomEye and underground services supplying product-filtered device addresses. They prioritize exposed VPN and firewall infrastructure (gbhackers.com, thehackernews.com).
- Tooling: a custom Python tool, "FortiGate Security Scanner", works through target lists concurrently (gbhackers.com). Scripts named
fortnew.pyandexploit_2026_0257.pywere also reported (thehackernews.com). - FortiWeb: the tool exploits CVE-2025-64446, a relative path traversal that gives unauthenticated administrative command execution. It creates an administrator account with unrestricted trusted-host access, then validates the credentials (gbhackers.com).
- FortiGate: it is not vulnerable to that flaw, so the tool brute-forces the REST API and pauses blocked targets for 60 seconds. After authentication, an optional function downloads the configuration and decrypts stored secrets using the default FortiOS AES key tied to CVE-2019-6693. This can yield LDAP bind credentials and a route into Active Directory (gbhackers.com).
- GlobalProtect: a separate scanner exploits CVE-2026-0257 via authentication-override cookie forgery. This requires authentication override and certificate reuse conditions (gbhackers.com). The flaw is described as a PAN-OS and Prisma Access authentication bypass (thehackernews.com).
- Foothold: an OpenConnect VPN connection is used for access.
- Post-exploitation: hands-on-keyboard activity with NetExec, Impacket, Kerbrute, Mimikatz, noPac, PetitPotam and SoftPerfect. This covers Active Directory, SMB and antivirus enumeration, Windows secret extraction, Kerberos service-account hash collection, and domain-admin pursuit via noPac and certificate-related attack chains.
- Persistence: MeshCentral at mesh[.]buttruyen[.]com managed 84 compromised endpoints across 28 active device groups. Another 100 groups were removed, so the historical victim count is unreliable. MeshAgents were served from agent[.]afahimsa[.]top (gbhackers.com). Other persistence includes Atera, Teramind, AnyDesk and the AdaptixC2 framework (thehackernews.com).
- Exfiltration: Rclone to Wasabi S3 buckets and MEGA cloud drives (thehackernews.com).
- Operation: multiple operator accounts and aliases point to a collaborative operation, possibly distributing or preparing access for sale (gbhackers.com).
- Geography: identified victims are about 38% Asia Pacific, 31.9% Latin America, 15.8% Europe and 12.7% MENA (thehackernews.com). k0t's stated priorities are the US and Canada, then Europe and selected APAC markets (thehackernews.com).
Remediação
- Remediate the vulnerabilities named in the report, including CVE-2025-64446 and CVE-2026-0257, by applying vendor fixes (thehackernews.com, gbhackers.com).
- Treat the response as both vulnerability management and intrusion response (gbhackers.com).
- Review unexpected administrator accounts and unauthorized VPN sessions on edge devices (gbhackers.com; the source text is truncated after this point).
Relatos divergentes
- Ransomware link: thehackernews.com (23 Oct) assesses k0t as an initial access broker or affiliate tied to Qilin and The Gentlemen, but also says the exact relationship is unclear. Gbhackers.com (22 Oct) says the victim overlaps only suggest brokerage and that ransomware affiliation is unconfirmed. Treat the link as an assessment, not a confirmed fact.
- FortiBleed: gbhackers.com notes possible links to the FortiBleed cluster but says the new credential dataset was not tied to FortiBleed or other tracked actors. Thehackernews.com says the campaigns overlap in timing, with only negligible overlap in compromised data.
- Regional scope: gbhackers.com says Asia Pacific and Latin America hold the largest shares of victims and that exposure patterns may explain this rather than deliberate regional targeting. Thehackernews.com gives percentages and separately cites stated priorities for the US, Canada and Europe. Thehackernews.com is the more recent source and gives more detail on this point.
Linha do tempo
-
k0t Mass-Exploits Fortinet and Palo Alto Edge Devices, Exposing 70,000+ Credentials; Links to Qilin and The Gentlemen
ler a análise desta fonte ocultar
Group-IB and NyxLab disclosed a large-scale campaign by the cybercriminal actor k0t (aliases CryptoFeel, Member19, QazWsxShop, first seen October 22, 2025) against exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect. The actor is assessed to be an initial access broker or affiliate tied to the Qilin and The Gentlemen ransomware groups, since many victims later appeared on their leak sites. More than 70,000 credentials tied to network devices and LDAP dumps were identified. Most compromises occurred between February and June 2026, overlapping with the FortiBleed credential harvesting campaign, although the researchers found only negligible overlap in compromised data. Victims are global: roughly 38% in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in MENA. k0t selects targets by device type and location rather than industry.
Technical Details
- Reconnaissance: scanning with FOFA and ZoomEye to enumerate internet-facing VPN and firewall appliances and build target lists.
- Initial access: exploitation of CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS and Prisma Access authentication bypass) using custom Python scripts
fortnew.pyandexploit_2026_0257.py, or brute-forcing common username and password combinations. - Foothold: an OpenConnect VPN connection.
- Post-exploitation: enumeration of Active Directory, SMB and installed antivirus, using NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz.
- Persistence: legitimate remote access tools (MeshCentral Agent, Atera, Teramind, AnyDesk) and the AdaptixC2 adversary-emulation framework.
- Exfiltration: Rclone to Wasabi S3 buckets and MEGA cloud drives.
- k0t's stated geographic priorities are the US and Canada, then Europe and selected APAC markets. The exact relationship with Qilin and The Gentlemen is unclear.
Remediation
- The researchers advise remediating the vulnerabilities named in the report, including CVE-2025-64446 and CVE-2026-0257.
-
k0t operator targets FortiGate, FortiWeb and GlobalProtect in credential theft campaign, exposing 70,000+ credentials
ler a análise desta fonte ocultar
Group-IB research describes a widespread campaign by an operator tracked as k0t that targets FortiGate, FortiWeb and Palo Alto GlobalProtect appliances to steal credentials, persist and exfiltrate corporate data. More than 70,000 exposed credentials were identified across network-device records, LDAP dumps and other artifacts. Many FortiGate compromises occurred between February and June 2026, with possible links to the FortiBleed cluster reported in June, although the new credential dataset was not tied to FortiBleed or other tracked actors. Victim overlaps with Qilin and The Gentlemen suggest possible initial-access brokerage, but ransomware affiliation is unconfirmed. Asia Pacific and Latin America hold the largest shares of identifiable victims, but researchers say exposure patterns, not deliberate regional targeting, may explain this.
Technical Details
- Target lists are built with FOFA, ZoomEye and underground services supplying product-filtered device addresses, prioritizing exposed VPN and firewall infrastructure over specific industries.
- A custom Python tool, "FortiGate Security Scanner", works through target lists concurrently. Against FortiWeb it attempts CVE-2025-64446 (relative path traversal giving unauthenticated administrative command execution), creates an administrator account with unrestricted trusted-host access, then validates the credentials.
- FortiGate is not vulnerable to that flaw, so the tool brute-forces the REST API instead, pausing blocked targets for 60 seconds. After authentication, an optional function downloads the configuration and decrypts stored secrets using the default FortiOS AES key tied to CVE-2019-6693. This can yield LDAP bind credentials and a route into Active Directory.
- A separate scanner exploits CVE-2026-0257 in GlobalProtect through authentication-override cookie forgery, which requires authentication override and certificate reuse conditions, then uses OpenConnect to establish VPN access.
- Post-compromise activity is hands-on-keyboard using NetExec, Impacket, Kerbrute and Mimikatz: Windows secret extraction, Kerberos service-account hash collection, and domain-admin pursuit via noPac and certificate-related attack chains.
- Persistence uses MeshCentral at mesh[.]buttruyen[.]com, managing 84 compromised endpoints across 28 active device groups (another 100 groups were removed, so the historical victim count is unreliable). MeshAgents were served from agent[.]afahimsa[.]top. Rclone handled exfiltration, and AdaptixC2 plus abused commercial remote-management tools provided extra command and control.
- Multiple operator accounts and aliases point to a collaborative operation, possibly distributing or preparing access for sale.
Remediation
- Apply vendor fixes and treat the response as both vulnerability management and intrusion response.
- Review unexpected administrator accounts, unauthorized VPN sessions and remote-management agents.
- Rotate exposed directory (LDAP/AD) credentials.
- For GlobalProtect, terminate active sessions after patching because existing access may survive remediation.