k0t Mass-Exploits Fortinet and Palo Alto Edge Devices, Exposing 70,000+ Credentials; Links to Qilin and The Gentlemen
Group-IB and NyxLab disclosed a large-scale campaign by the cybercriminal actor k0t (aliases CryptoFeel, Member19, QazWsxShop, first seen October 22, 2025) against exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect. The actor is assessed to be an initial access broker or affiliate tied to the Qilin and The Gentlemen ransomware groups, since many victims later appeared on their leak sites. More than 70,000 credentials tied to network devices and LDAP dumps were identified. Most compromises occurred between February and June 2026, overlapping with the FortiBleed credential harvesting campaign, although the researchers found only negligible overlap in compromised data. Victims are global: roughly 38% in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in MENA. k0t selects targets by device type and location rather than industry.
Entenda a falha
A vulnerabilidade
The story covers two flaws that the actor k0t exploits on internet-facing edge devices. CVE-2026-0257 is an authentication bypass in Palo Alto Networks PAN-OS and Prisma Access. CVE-2025-64446 is a path traversal in Fortinet FortiWeb. The articles do not give severity scores, affected or fixed versions, or the exact preconditions. Both are described as exploitable against exposed devices, so network reach to the appliance is the evident requirement. The result is initial access to the device and the network behind it. k0t also brute-forces common username and password combinations against these devices. Group-IB and NyxLab only tell defenders to remediate the vulnerabilities in the report.
Como funciona
The articles do not describe the internal mechanism of either flaw. What they describe is the attack flow around them. The actor first uses FOFA and ZoomEye to list internet-facing VPN and firewall appliances and filters them by product. It then sends the exploit for the flaw (path traversal on FortiWeb, authentication bypass on PAN-OS and Prisma Access) or tries common credentials. After gaining access, it opens an OpenConnect VPN connection as a foothold and moves on to Active Directory and SMB enumeration and credential theft.
Por que é vulnerável
The articles do not explain the root cause of either flaw or what the fixes change. By their classification, CVE-2025-64446 is a path traversal, which points to input that is not properly restricted to the intended paths. CVE-2026-0257 is an authentication bypass, which means a check that should require authentication can be skipped. Beyond these labels, nothing is stated, and the cause should not be inferred.
Como foi descoberta
The campaign was disclosed in a joint investigation by Group-IB and NyxLab, reported on October 23, 2026. The researchers attribute it to k0t (aliases CryptoFeel, Member19, QazWsxShop), first seen on October 22, 2025, based on artifacts from the investigation and the actor's dark web activity. The articles do not say who first found the two CVEs or how they were reported to the vendors. Both are called known vulnerabilities, and the exploitation was seen in the wild, mostly between February and June 2026.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 12:16.
2 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2025-64446. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
FortiWeb 8.0.2 - Remote Code Execution
This script targets the FortiWeb management interface over the network, with no credentials needed. It abuses a path-traversal flaw in the user-creation API to add a rogue administrator, which matches the authentication-bypass part of CVE-2025-64446 on unpatched builds. It then logs in and tries to turn the backup upload feature into a web shell for a root reverse shell. The RCE stage looks speculative, the file is unverified, and it has a coding error that would stop it running unmodified, so treat it as a rough proof of concept. Patch and keep the management interface off the internet.
-
Fortinet FortiWeb v8.0.1 - Auth Bypass
This file is a write-up, not an exploit. It claims CVE-2025-64446 is a path traversal in how FortiWeb's web interface normalizes request paths, letting an unauthenticated remote attacker reach administrative functions without user interaction, on versions 7.0 through 8.0.1. The payload is withheld and the reproduction is sent to a paid external page, so there is no code, proof of concept or exposure check, and Exploit-DB did not verify it. Defenders should patch to the fixed releases and keep management interfaces off the internet.
Detalhes técnicos
- Reconnaissance: scanning with FOFA and ZoomEye to enumerate internet-facing VPN and firewall appliances and build target lists.
- Initial access: exploitation of CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS and Prisma Access authentication bypass) using custom Python scripts
fortnew.pyandexploit_2026_0257.py, or brute-forcing common username and password combinations. - Foothold: an OpenConnect VPN connection.
- Post-exploitation: enumeration of Active Directory, SMB and installed antivirus, using NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz.
- Persistence: legitimate remote access tools (MeshCentral Agent, Atera, Teramind, AnyDesk) and the AdaptixC2 adversary-emulation framework.
- Exfiltration: Rclone to Wasabi S3 buckets and MEGA cloud drives.
- k0t's stated geographic priorities are the US and Canada, then Europe and selected APAC markets. The exact relationship with Qilin and The Gentlemen is unclear.
Remediação
- The researchers advise remediating the vulnerabilities named in the report, including CVE-2025-64446 and CVE-2026-0257.
Linha do tempo
-
k0t Mass-Exploits Fortinet and Palo Alto Edge Devices, Exposing 70,000+ Credentials; Links to Qilin and The Gentlemen
ler a análise desta fonte ocultar
Group-IB and NyxLab disclosed a large-scale campaign by the cybercriminal actor k0t (aliases CryptoFeel, Member19, QazWsxShop, first seen October 22, 2025) against exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect. The actor is assessed to be an initial access broker or affiliate tied to the Qilin and The Gentlemen ransomware groups, since many victims later appeared on their leak sites. More than 70,000 credentials tied to network devices and LDAP dumps were identified. Most compromises occurred between February and June 2026, overlapping with the FortiBleed credential harvesting campaign, although the researchers found only negligible overlap in compromised data. Victims are global: roughly 38% in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in MENA. k0t selects targets by device type and location rather than industry.
Technical Details
- Reconnaissance: scanning with FOFA and ZoomEye to enumerate internet-facing VPN and firewall appliances and build target lists.
- Initial access: exploitation of CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS and Prisma Access authentication bypass) using custom Python scripts
fortnew.pyandexploit_2026_0257.py, or brute-forcing common username and password combinations. - Foothold: an OpenConnect VPN connection.
- Post-exploitation: enumeration of Active Directory, SMB and installed antivirus, using NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz.
- Persistence: legitimate remote access tools (MeshCentral Agent, Atera, Teramind, AnyDesk) and the AdaptixC2 adversary-emulation framework.
- Exfiltration: Rclone to Wasabi S3 buckets and MEGA cloud drives.
- k0t's stated geographic priorities are the US and Canada, then Europe and selected APAC markets. The exact relationship with Qilin and The Gentlemen is unclear.
Remediation
- The researchers advise remediating the vulnerabilities named in the report, including CVE-2025-64446 and CVE-2026-0257.