A crew that scans the internet for exposed firewalls and VPN portals has collected more than 70,000 credentials and hands-on-keyboard access to corporate networks around the world, according to a joint investigation by Group-IB Threat Intelligence and NyxLab. The operator at the centre of it goes by the handle k0t, and many of the organisations it reached were later listed on the leak sites of the Qilin and The Gentlemen ransomware gangs.
The report, by Group-IB's Tsai Shun Ling, Nikolay Kichatov, KT Gan and Chris Au, assesses that k0t and its collaborators are likely acting as initial access brokers, the middlemen who break in and then sell or pass on the foothold. Group-IB stresses that the link to the two ransomware groups is unconfirmed: the overlap is in victims, not in proven affiliation.
Targets picked by product, not by industry
k0t does not research individual companies. The operator pulls bulk lists of internet-facing appliances from attack-surface search engines such as FOFA and ZoomEye, and from underground services that sell product-filtered IP lists. GlobalProtect portals were the most prominent search target, followed by FortiWeb and FortiGate. Asia Pacific accounts for 37.6% of the unique victim domains in the dataset, but Group-IB cautions that this likely reflects where poorly configured devices sit rather than deliberate regional targeting.
Two scripts that open the front door
The main Fortinet tool, self-named "FortiGate Security Scanner", first tries CVE-2025-64446, a path traversal flaw in FortiWeb, to create a new local administrator that can log in from any address. FortiGate devices are not vulnerable to that bug, so the tool falls back to brute-forcing the REST API, pausing for 60 seconds whenever it hits the FortiGate lockout. Once in, it can export the device configuration and decrypt stored secrets with the default FortiOS AES key (the long-known weakness tracked as CVE-2019-6693), recovering LDAP and Active Directory credentials.
A second tool, credited in its code to a developer called "BeiDou", exploits CVE-2026-0257 in Palo Alto GlobalProtect by forging an authentication-override cookie on vulnerable configurations, then opens a VPN session through OpenConnect. IntelFusions reported exploitation of that flaw in June.
From VPN session to domain admin
Inside networks the operators worked by hand with standard offensive tooling, including NetExec, Impacket, Mimikatz and the noPac exploit for CVE-2021-42278 and CVE-2021-42287 to reach Domain Admin. For persistence they enrolled machines into a MeshCentral server that, at the time of analysis, held 28 active device groups covering 84 compromised devices. AdaptixC2, Atera and AnyDesk were also used, and data left via Rclone to Wasabi S3 buckets and MEGA.
Group-IB compared the stolen credentials with the earlier FortiBleed campaign and found negligible overlap. It assesses with moderate confidence that k0t's activity is associated with the broader FortiBleed activity, while noting the evidence does not show the same operators controlled both datasets.
Patch FortiWeb and GlobalProtect, then rotate stored secrets
Patch FortiWeb for CVE-2025-64446 and PAN-OS for CVE-2026-0257, keep management interfaces off the internet, and turn on FortiOS private-data-encryption so stored secrets are not protected only by the default key. Hunt for unexpected local administrators, configuration exports and trusted-host changes on appliances, and treat any LDAP or VPN credentials stored on an exposed device as potentially compromised. Because legitimate remote-management tools can look like routine administration, the researchers advise correlating appliance, VPN, identity and endpoint telemetry.
Indicators
- MeshCentral: mesh[.]buttruyen[.]com, agents from agent[.]afahimsa[.]top
- AdaptixC2: hxxps://64[.]94[.]85[.]14:4321/endpoint and 168[.]100[.]11[.]99
- Agent staging: hxxp://162[.]33[.]178[.]213:8888/, sthyjk[.]com, alknene[.]shop
- Fake installer: clear-thinking_61.92.4_INSTALL.exe
An edge device is not just a door, it is a keyring. Whoever gets admin on a firewall also inherits every directory credential it was trusted with, and a broker working at k0t's scale can keep ransomware crews supplied for months.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.