k0t campaign steals more than 70,000 credentials from Fortinet and Palo Alto devices
Researchers at Group-IB and NyxLab say a threat actor known as k0t used known vulnerabilities and brute-force attacks against exposed Fortinet and Palo Alto Networks devices between February and June 2026. The campaign exposed more than 70,000 credentials, including LDAP data, and the researchers say some victims later appeared on ransomware groups’ data-leak sites.
Bottom line — Researchers link some victims to Qilin and The Gentlemen, but say k0t’s relationship with the ransomware groups is unclear.
Go deeper 6
-
Group-IB and NyxLab report that 15.8% of victims were in Europe.
-
The researchers say k0t used FOFA and ZoomEye to find exposed devices, then deployed custom scripts and common-password attacks.
-
Stolen data included network-device credentials and LDAP dumps, which were exfiltrated to Wasabi S3 and MEGA, according to Group-IB and NyxLab.
-
The researchers say attackers used tools including MeshCentral and Atera to maintain access and tools such as Mimikatz to deepen it.
-
Group-IB and NyxLab say k0t may operate as an initial access broker, selling access to other criminals.
-
Cyberend reports that researchers advise organisations to patch the vulnerabilities; it found no reported vendor statements or official figures for financial losses.