k0t Campaign Exposes 70,000 Firewall and VPN Credentials: What to Check on FortiGate, FortiWeb and GlobalProtect

Most small businesses think of their firewall as the thing that keeps attackers out. In October 2026, researchers showed how often it is the way in. A report published on October 21 by Group-IB and NyxLab describes a campaign by a threat actor known as k0t that broke into Fortinet and Palo Alto Networks edge devices, exposed more than 70,000 credentials and used them to move deep into victims’ networks.

Nothing in this campaign required a new, unknown vulnerability. It relied on default passwords, management pages left open to the internet, configuration secrets protected by a publicly known key, and patches that were available but not applied. That is exactly why it matters to small firms: every one of those gaps can be found and closed.

The campaign at a glance

How the attack worked

According to Group-IB, the operators did not pick victims by industry. They searched internet-scanning services such as FOFA and ZoomEye for exposed Fortinet and GlobalProtect devices and then ran tools against them in bulk. Their stated priorities began with the United States and Canada, followed by Europe and parts of Asia-Pacific.

1. Get a login. A custom “FortiGate Security Scanner” tried the FortiWeb exploit and, on FortiGate devices, fell back to guessing common credentials. It paused for 60 seconds whenever a device locked it out, which the researchers note matches FortiGate’s default lockout time.
2. Download the configuration. Once logged in, the attackers exported the device configuration and decrypted the stored secrets offline using a known default FortiOS key (CVE-2019-6693). That revealed administrator passwords, local VPN users and, most importantly, the account the firewall uses to talk to the company’s Active Directory.
3. Move inside. With those credentials and a VPN connection, they used common hacking tools to reach domain administrator rights, the keys to every computer and account in the office.
4. Stay and steal. They installed remote-management software (MeshCentral agents, AdaptixC2, Atera, AnyDesk, ngrok) to keep access and copied data out with Rclone to Wasabi and MEGA cloud storage.

Group-IB says the operators were likely working as initial access brokers, people who break in and sell the access. Some victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups, although the link has not been confirmed.

“A firewall with a default password and an open admin page is not a wall. It is a front door with the key under the mat.”

NyorsoftExternal Security Review

Why this matters for small businesses

A small office often has exactly one device standing between the internet and everything else: a FortiGate or similar firewall that also provides the VPN for remote staff. It was set up by an IT provider years ago, works quietly and is rarely looked at. In this campaign, that single device was enough to reach the whole network.

The data at stake is not only the firewall itself. The configuration typically holds the Active Directory service account, VPN user passwords and sometimes keys for other systems. Researchers at NyxLab advise treating a compromised edge device as a potential company-wide credential compromise, not just a patching problem.

For tax preparers, accountants and mortgage brokers covered by the FTC Safeguards Rule, there is a compliance angle too: the Rule requires multi-factor authentication for anyone accessing your information systems, which includes the VPN and the firewall’s admin login.

What to check this week

If you have a Fortinet or Palo Alto device, or you are not sure what your IT provider installed, go through this list with them.

1. Is the admin page reachable from the internet?

Ask your provider whether HTTPS or SSH management is enabled on the internet-facing (WAN) interface. It should not be. Management should be possible only from inside the office network, over the VPN or from a short list of fixed IP addresses. This one change would have stopped the brute-force step entirely.

2. Are any default or shared passwords still in use?

Rename or disable the default admin account, give every administrator a personal account with a long, unique password, and turn on multi-factor authentication for both admin logins and the VPN. Group-IB also recommends a longer lockout time than the default after failed logins.

3. Are the devices patched?

• FortiWeb: CVE-2025-64446 is fixed in 8.0.2, 7.6.5, 7.4.10, 7.2.12 and 7.0.12. Exploitation has been reported since October 2025.
• Palo Alto GlobalProtect: CVE-2026-0257 affects portals and gateways with authentication-override cookies enabled. Palo Alto Networks lists fixed PAN-OS releases for 10.2, 11.1, 11.2 and 12.1 in its advisory; as a workaround, disable the cookie options or use a dedicated certificate for them.
• FortiGate: install the latest firmware for your branch and check that the device is still supported by Fortinet.

4. Are stored secrets protected by your own key?

By default, FortiGate encrypts passwords in its configuration with a key that is publicly known. Fortinet’s private-data-encryption setting replaces it with a key you choose. Turn it on, and keep in mind that it protects future exports only: if a configuration may already have leaked, the passwords inside it must be changed.

5. Is there anything on the device you did not create?

Review the list of administrator accounts, the “trusted hosts” on each one (the attackers set it to 0.0.0.0/0, meaning anywhere), recent configuration backups or exports, and VPN logins from unusual countries or at unusual times.

6. Is unknown remote-access software running inside?

Ask whoever manages your computers to look for tools nobody approved: MeshAgent, AdaptixC2, Atera, AnyDesk, ngrok or Rclone. Legitimate IT providers use some of these too, so the question is not “is it installed” but “did we install it”.

If you find signs of compromise

1. Disconnect management access from the internet immediately and keep the device’s logs.
2. Change every credential stored on the device: administrator accounts, VPN users, the Active Directory or LDAP service account and any keys for connected systems.
3. Remove unknown admin accounts and remote-access tools, then update the firmware.
4. Assume the attackers may have gone further: have your IT provider or an incident response firm check domain administrator accounts and servers.
5. If you handle customer financial data, check your notification duties. Under the Safeguards Rule, certain breaches affecting 500 or more consumers must be reported to the FTC.

What an outside view can tell you

An attacker’s first step in this campaign was simply finding devices with their management or VPN pages exposed. You can see the same thing from outside. An external website security review or our Safeguards external assessment checks which login portals, admin pages and VPN gateways your domain exposes to the internet and whether they reveal outdated versions. It cannot tell you whether a device has already been breached; for that you need someone with access to its logs and configuration.

Sources

• Group-IB: Stray Cat, Open Doors – How k0t Wanders Through the Network Edge (October 21, 2026)
• Check Point Research: Threat Intelligence Report, October 26, 2026
• Daily CyberSecurity: Suspected access broker k0t hits FortiGate and GlobalProtect devices (October 23, 2026)
• Palo Alto Networks: CVE-2026-0257 security advisory
• Arctic Wolf: CVE-2025-64446 in FortiWeb
• eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information

This article summarises public research as of October 27, 2026. Group-IB has announced a more detailed technical report; check the vendors’ advisories for the latest fixed versions.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team