RESOURCE
A joint Group-IB and NyxLab investigation attributes a campaign against internet exposed firewalls and VPN appliances to an actor tracked as k0t, linked to the Qilin and The Gentlemen ransomware operations. The actor exploited CVE-2025-64446 in Fortinet FortiWeb and CVE-2026-0257 in Palo Alto PAN-OS and Prisma Access, or simply brute forced common passwords, then used legitimate remote access tools for persistence; more than 70,000 credentials tied to network devices and directory dumps were exposed.
Fabric Networks
Start with a conversation about your cryptographic posture.
The Hacker News reported on October 23, 2026 on a Group-IB and NyxLab investigation into a threat actor called k0t that has gained access to numerous organizations worldwide by enumerating exposed network appliances at scale rather than researching individual targets. Affected products are Fortinet FortiGate and FortiWeb and Palo Alto Networks GlobalProtect, PAN-OS and Prisma Access. Initial access came through exploit scripts for CVE-2025-64446 and CVE-2026-0257 or through brute forcing common username and password pairs, followed by an OpenConnect VPN foothold, Active Directory enumeration, persistence through MeshCentral, Atera, Teramind and AnyDesk, and exfiltration with Rclone to cloud storage. Much of the activity ran from February to June 2026 and overlapped with the FortiBleed credential harvesting campaign.
The researchers link k0t to the Qilin and The Gentlemen ransomware groups, likely as an initial access broker or affiliate. Their recommendation is plain: remediate the named vulnerabilities and check for prior exploitation.
Two things about this campaign should bother a Canadian operator. The actor did not pick targets; it scanned for appliances. And a share of the access came from guessable passwords, not from a zero day. Fortinet is a Fabric partner and FortiGate is on the edge of a great many Canadian utilities, municipalities and carriers; the Cyber Centre's AV26-1081 hardening release for FortiOS and FortiManager landed the same day as this report. Patching is the floor. Knowing every edge device you own, which firmware it runs, what it trusts and who can reach its management plane is what Encryption Intelligence gives you, observed on the wire. Disable, isolate or tunnel, not run alongside.