As reported by The Hacker News, a joint investigation by Group-IB and NyxLab has uncovered a sprawling campaign by threat actor k0t (aka CryptoFeel, Member19, QazWsxShop) that has compromised enterprise firewalls and VPNs worldwide, exposing over 70,000 credentials. The actor's ties to ransomware groups Qilin and The Gentlemen signal a well-established initial access broker (IAB) pipeline — one that defenders must disrupt before downstream extortion occurs.

Security Impact: As reported by The Hacker News, a joint investigation by Group-IB and NyxLab has uncovered a sprawling campaign by threat actor k0t (aka CryptoFeel, Member19, QazWsxShop) that has compromised enterprise firewalls and VPNs worldwide, exposing over 70,000 credentials.

Why This Matters

This campaign is a textbook example of why network-edge appliances remain the Achilles' heel of enterprise security. Firewalls and VPN concentrators sit at the trust boundary, yet they are frequently under-patched, internet-exposed, and lack the telemetry visibility that internal endpoints enjoy. The k0t operator's methodology — combining public scanning tools (FOFA, ZoomEye) with bespoke Python exploit scripts and brute-force credential stuffing — is neither novel nor sophisticated. That is precisely the point: defenders are losing to low-complexity attacks on high-value assets.

The overlap with the FortiBleed campaign timeline (February–June 2026) suggests either a shared toolkit ecosystem or operational convergence among IABs targeting the same vendor ecosystems. The geographic distribution — with APAC and Latin America accounting for nearly 70% of victims — points to regional patch latency and weaker edge-device governance as compounding factors.

Exploited Vulnerabilities

CVEProductVulnerability TypePatch Status
CVE-2025-64446Fortinet FortiWebPath TraversalPatch available — refer to Fortinet PSIRT
CVE-2026-0257Palo Alto PAN-OS / Prisma AccessAuthentication BypassPatch available — refer to Palo Alto Security Advisories

Both vulnerabilities have been observed under active exploitation in the wild, with bespoke tooling specifically tailored for mass exploitation.

Who Is at Risk

Who Is at Risk
Organizations with internet-facing FortiGate, FortiWeb, or Palo Alto GlobalProtect appliances — especially those with delayed patch cadences or no virtual patching layer.
SMBs and mid-market enterprises in APAC and Latin America, where managed security provider coverage may be thinner and patch management maturity is lower.
Environments relying on default or weak administrative credentials on edge devices — the brute-force component of this campaign indicates that credential hygiene remains a primary failure mode.
Organizations without egress monitoring — the use of Rclone for exfiltration to Wasabi S3 and MEGA means that without DLP or cloud-egress controls, data theft can proceed undetected for months.

Broader Implications: The IAB Economy Maturing

The k0t actor's dark-web activity — purchasing exploit code, premium FOFA/ZoomEye accounts, and tooling — illustrates the professionalization of the IAB market. Initial access is being commodified at scale, with edge-device exploits serving as the primary entry product. The downstream connection to Qilin and The Gentlemen ransomware operations means that every compromised firewall is potentially a future ransomware patient zero.

Equally concerning is the persistence toolkit: MeshCentral Agent, Atera, Teramind, AnyDesk, and AdaptixC2 are all dual-use tools that blend into legitimate administrative activity. Defenders who rely solely on signature-based detection will miss these implants entirely.

Shield53 Recommendations

Immediate Actions

  • Patch all FortiWeb and PAN-OS appliances to versions addressing CVE-2025-64446 and CVE-2026-0257 respectively. If patching is delayed, apply virtual patches via WAF or IPS signatures where available.
  • Audit all edge-device administrative accounts — rotate credentials, enforce MFA where supported, and disable any dormant accounts. Check for indicators of compromise: unexpected OpenConnect VPN sessions, unfamiliar remote management agents (MeshCentral, Atera, Teramind, AnyDesk), and unauthorized Rclone installations.
  • Restrict management interfaces to jump-host-only access. No firewall or VPN admin panel should be reachable from the open internet without VPN or allowlisting.
  • Deploy egress monitoring — flag and block outbound transfers to MEGA, Wasabi, and other consumer cloud storage from server and appliance subnets. Rclone should not be running on infrastructure devices unless explicitly provisioned.

Strategic Hardening

  • Implement a 30-day SLA for edge-device critical patches. Network perimeter appliances should be treated with the same urgency as domain controllers and email servers.
  • Enable full session logging on all VPN concentrators and feed logs into your SIEM with alerting on anomalous session origin, duration, and data-transfer volume.
  • Conduct quarterly external attack surface management (EASM) scans to identify forgotten or shadow edge devices that may be running unpatched firmware.
  • Hunt for AdaptixC2 and MeshCentral beacons in your environment using network-traffic analysis — these tools generate distinctive traffic patterns that EDR and NDR can detect.

The k0t campaign is not a sophisticated supply-chain attack or a zero-day exploit chain. It is the predictable outcome of unpatched edge devices, weak credentials, and absent egress monitoring. The defensive playbook is known — the question is whether organizations will execute it before the next IAB comes knocking.