RESOURCE
Une enquête conjointe de Group-IB et NyxLab attribue une campagne visant des pare-feu et des appareils VPN exposés à Internet à un acteur suivi sous le nom de k0t, lié aux opérations de rançongiciel Qilin et The Gentlemen. L'acteur a exploité la CVE-2025-64446 dans Fortinet FortiWeb et la CVE-2026-0257 dans Palo Alto PAN-OS et Prisma Access, ou a simplement forcé des mots de passe courants, puis a utilisé des outils d'accès distant légitimes pour la persistance; plus de 70 000 identifiants liés à des équipements réseau et à des extractions d'annuaires ont été exposés.
Fabric Networks
Start with a conversation about your cryptographic posture.
The Hacker News reported on October 23, 2026 on a Group-IB and NyxLab investigation into a threat actor called k0t that has gained access to numerous organizations worldwide by enumerating exposed network appliances at scale rather than researching individual targets. Affected products are Fortinet FortiGate and FortiWeb and Palo Alto Networks GlobalProtect, PAN-OS and Prisma Access. Initial access came through exploit scripts for CVE-2025-64446 and CVE-2026-0257 or through brute forcing common username and password pairs, followed by an OpenConnect VPN foothold, Active Directory enumeration, persistence through MeshCentral, Atera, Teramind and AnyDesk, and exfiltration with Rclone to cloud storage. Much of the activity ran from February to June 2026 and overlapped with the FortiBleed credential harvesting campaign.
The researchers link k0t to the Qilin and The Gentlemen ransomware groups, likely as an initial access broker or affiliate. Their recommendation is plain: remediate the named vulnerabilities and check for prior exploitation.
Two things about this campaign should bother a Canadian operator. The actor did not pick targets; it scanned for appliances. And a share of the access came from guessable passwords, not from a zero day. Fortinet is a Fabric partner and FortiGate is on the edge of a great many Canadian utilities, municipalities and carriers; the Cyber Centre's AV26-1081 hardening release for FortiOS and FortiManager landed the same day as this report. Patching is the floor. Knowing every edge device you own, which firmware it runs, what it trusts and who can reach its management plane is what Encryption Intelligence gives you, observed on the wire. Disable, isolate or tunnel, not run alongside.