A widespread campaign targeting FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances to steal credentials, establish persistent access, and exfiltrate corporate data.
The investigation associates the activity with an operator known as k0t and identifies more than 70,000 exposed credentials across network-device records, LDAP dumps and other operational artifacts.
Researchers identified potential connections to the FortiBleed cluster reported in June, with many FortiGate compromises occurring between February and June 2026.
However, the newly uncovered credential dataset was not linked to previously tracked actors, including FortiBleed.
Victim overlaps with Qilin and The Gentlemen suggest possible initial-access brokerage, but direct ransomware affiliations remain unconfirmed.
The operators assemble target lists using FOFA, ZoomEye and underground services supplying product-filtered device addresses.
Their reconnaissance prioritizes exposed VPN and firewall infrastructure rather than specific industries.
Asia Pacific and Latin America account for the largest shares of identifiable victim domains, although researchers caution that exposure patterns, not deliberate regional targeting, may explain this distribution.
A custom Python utility, “FortiGate Security Scanner,” processes target lists concurrently and attempts CVE-2025-64446 exploitation against FortiWeb.
Fortinet describes the vulnerability as relative path traversal enabling unauthenticated administrative command execution through crafted HTTP or HTTPS requests.
K0T Credential Theft
According to GroupIB investigation, the scanner creates an administrator account with unrestricted trusted-host access, then validates the credentials.
FortiGate appliances are not vulnerable to this FortiWeb flaw; instead, the tool attempts credential brute-forcing against their REST API.
Its lockout-handling logic pauses blocked targets for 60 seconds before retrying. Following successful authentication, an optional configuration-parsing function downloads appliance settings and decrypts stored secrets using the known default FortiOS AES key associated with CVE-2019-6693.
Recovered material can include LDAP bind credentials, providing a route from perimeter compromise into Active Directory.
For GlobalProtect, operators use a separate scanner exploiting CVE-2026-0257 through authentication-override cookie forgery.
The vulnerability permits unauthorized VPN connections on affected configurations, requiring authentication override and certificate reuse conditions.
The tooling subsequently invokes OpenConnect to establish network access.
Once inside, operators conduct hands-on-keyboard discovery and credential harvesting using NetExec, Impacket, Kerbrute and Mimikatz.
Observed activity includes extracting Windows secrets, collecting Kerberos service-account hashes and pursuing domain-administrator privileges through noPac and certificate-related attack chains.
Persistence extends beyond VPN access. Researchers identified MeshCentral infrastructure at mesh[.]buttruyen[.]com managing 84 compromised endpoints across 28 active device groups.
Another 100 groups had been removed, preventing those historical entries from establishing a reliable current victim count.
MeshAgents were distributed through agent[.]afahimsa[.]top, separating payload hosting from the management server.
Rclone handled data exfiltration, while AdaptixC2 supplied an additional command-and-control channel alongside abused commercial remote-management tools.
Multiple operator accounts and aliases indicate a collaborative operation, potentially distributing access among intruders or preparing it for sale.
Group-IB’s separate research documents Qilin’s affiliate model and The Gentlemen’s reliance on compromised Fortinet infrastructure, making the observed overlaps relevant without establishing attribution.
Defenders should treat remediation as both vulnerability management and intrusion response.
Apply vendor fixes, review unexpected administrator accounts, investigate unauthorized VPN sessions and remote-management agents, and rotate exposed directory credentials.
GlobalProtect incident guidance also recommends terminating active sessions after patching because existing access may survive remediation.
IOCs
| Category | Indicator type | Indicator |
|---|---|---|
| MeshCentral C2 | Domain | mesh[.]buttruyen[.]com |
| MeshCentral C2 | IP address | 62[.]60[.]131[.]43 |
| AdaptixC2 server | IP address | 64.94.85.14 |
| AdaptixC2 server | IP address | 168.100.11.99 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
