- A large-scale campaign targeting Fortinet and Palo Alto Networks firewalls has been disclosed, with threat actor k0t linked to ransomware groups such as Qilin and The Gentlemen.
- The actor exploits known vulnerabilities including CVE-2025-64446 and CVE-2026-0257, then uses legitimate remote access tools for persistence and data exfiltration via Rclone to Wasabi S3 and MEGA cloud storage.
- Over 70,000 exposed credentials have been identified, with nearly 70% of victims in Asia Pacific and Latin America, posing a direct risk to cryptocurrency exchanges and blockchain firms.
Cybersecurity researchers from Group-IB and NyxLab have disclosed a large-scale campaign that has compromised exposed network edge devices, potentially endangering cryptocurrency firms worldwide. The threat actor, known as k0t and aliases CryptoFeel, Member19, and QazWsxShop, was first observed in October 2025 and shares connections with ransomware groups Qilin and The Gentlemen.
According to a joint investigation, the actor operates as an initial access broker or affiliate, targeting Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. “Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration.”
The attack chain begins with reconnaissance using public scanning tools like FOFA and ZoomEye to enumerate vulnerable appliances. Exploitation leverages known flaws such as CVE-2025-64446 and CVE-2026-0257, or brute-force attacks, to gain initial access via OpenConnect VPN.
Post-compromise, the actor uses legitimate tools like MeshCentral Agent, Atera, and AnyDesk for persistence, along with the AdaptixC2 framework. Data is exfiltrated using Rclone into Wasabi S3 buckets and MEGA cloud drives.
Victims are global and indiscriminate, with 38% in Asia Pacific, 31.9% in Latin America, and the rest across Europe and the Middle East. The campaign overlaps with another credential harvesting operation codenamed FortiBleed, though researchers found negligible overlap in compromised data.
“k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations,” the researchers stated, adding that product and location matter more than industry. Organizations are advised to patch the identified vulnerabilities immediately to prevent compromise and potential ransomware deployment.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
