Group-IB and NyxLab have uncovered a campaign by the actor k0t that scans the internet for vulnerable Fortinet and Palo Alto firewalls and VPNs, regardless of sector or size. It is linked to Qilin ransomware. If you have an exposed FortiGate or GlobalProtect, patch it today, enforce MFA and rotate your VPN passwords.
Key facts
- Group-IB and NyxLab published a joint investigation that The Hacker News reported on 23 October 2026. They identified more than 70,000 credentials linked to network devices and LDAP dumps.
- The actor is known as k0t (aliases CryptoFeel, Member19 and QazWsxShop) and was first seen on 22 October 2025. It is associated with Qilin and The Gentlemen, probably as an initial access broker or affiliate.
- It exploits CVE-2025-64446 (path traversal in FortiWeb) and CVE-2026-0257 (authentication bypass in PAN-OS and Prisma Access, CVSS 7.8), plus brute force with common usernames and passwords.
- Palo Alto patched CVE-2026-0257 in May 2026, but according to a Unit 42 report from 20 October covered by The Hacker News, Qilin and INC are still exploiting it to bypass MFA and open VPN sessions.
- Victims by region: 38% Asia-Pacific, 31.9% Latin America, 15.8% Europe and 12.7% Middle East and North Africa.
Am I affected if I have a FortiGate or GlobalProtect?
If it is reachable from the internet, you are on its radar. According to the researchers, k0t picks targets by enumerating exposed devices at scale, without researching specific organisations. It does not need to know your company's name: it only needs your VPN to respond. Its stated priorities are the US and Canada, followed by Europe and some Asia-Pacific markets.
Getting in does not always require a vulnerability. Brute force with common passwords works against any VPN with a generic account and a weak password.
What does k0t do once inside?
It sets up an OpenConnect VPN connection, steals more credentials and enumerates Active Directory, SMB shares and the installed antivirus. To stay in, it installs legitimate remote access tools (MeshCentral Agent, Atera, Teramind, AnyDesk) and the AdaptixC2 framework. It also uses Mimikatz, Impacket and NetExec, and exfiltrates data.
Many of these tools are the same ones an IT provider uses. Antivirus will not always flag them as malicious. That is why you need to know which ones you installed yourself.
Are there victims in Spain?
The published data does not break it down. Europe accounts for 15.8% of victims and is among the actor's priorities. Since it does not choose by sector or name, the lack of Spanish figures is no reason to relax.
What to do today
- Ask your IT provider or MSP for an inventory of every VPN and firewall reachable from the internet.
- Check that PAN-OS and FortiOS/FortiWeb have all patches applied, including the one for CVE-2026-0257. If you cannot patch right away, apply the vendor mitigation: disable "authentication override" or use a dedicated certificate for cookies, according to Dark Reading.
- Close the device's management interface to the internet and enforce MFA on the VPN.
- Change VPN, admin and linked service account passwords, especially if they have not been rotated this year.
- Review logs for unusual VPN connections, remote access tools you did not install (AnyDesk, Atera, MeshCentral) and unusual data uploads.
- If you manage services for others, or others manage yours, ask your providers whether they have exposed devices.
What it means for a small business
The VPN is the front door of almost any company with remote work, and this campaign confirms it is the attacker's front door too. The fact that k0t does not research its victims kills the "we're small, nobody is looking for us" argument. Nobody is looking for you: a scanner finds you.
Our position: if your Palo Alto device has gone unpatched since May, patching today is not enough. A patch closes the door, but it does not remove whoever already got in. Review logs and rotate credentials as if there had been an intrusion. The link to Qilin and The Gentlemen shows how this usually ends: someone gets the entry point and a ransomware group exploits it.
The most cost-effective step is to reduce what you expose. A management interface that cannot be seen from the internet cannot be attacked from the internet. If you are not sure what you have exposed, that inventory is the first step, and it is what we work on in cybersecurity for SMEs.
One limitation: this data comes from The Hacker News summary of the Group-IB and NyxLab report. We have not been able to review the original report.
Frequently asked questions
Is applying the CVE-2026-0257 patch enough?
No. k0t also gets in through brute force with common passwords, and if it was already inside, the patch does not remove the remote access tools it left behind. Patch, rotate passwords and review logs.
Does MFA protect me?
It helps, but according to Unit 42, Qilin and INC exploit CVE-2026-0257 precisely to bypass MFA. MFA and patching have to go together.
What is an initial access broker?
An actor who breaks into networks and usually sells that access to ransomware groups. It is the role researchers most likely attribute to k0t.
Sources
- The Hacker News – Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
- The Hacker News – Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
- INCIBE-CERT – CVE-2026-0257
- Dark Reading – Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit
