A sprawling, large-scale cyber espionage and initial access campaign has targeted exposed network edge devices across the globe, compromising enterprise firewalls and virtual private network appliances to harvest more than 70,000 credentials. The widespread malicious activity, uncovered through a joint investigation by cybersecurity researchers, targets vulnerable hardware manufactured by companies such as Fortinet and Palo Alto Networks.
Investigators revealed that the threat actor behind the operation—tracked under the moniker k0t, who also utilizes aliases such as CryptoFeel, Member19, and QazWsxShop—first emerged in October 2025. Technical analysis indicates that the actor maintains connections with prominent ransomware organizations, including Qilin and The Gentlemen, likely acting as an initial access broker or operational affiliate. The campaign’s operators have successfully obtained access to numerous organizations worldwide, deploying persistent remote access tools and exfiltrating proprietary data.
The intrusion vector relies on the indiscriminate mass enumeration of internet-facing edge devices. Attackers utilize public metadata search engines and scanning tools such as FOFA and ZoomEye to compile target lists of potentially vulnerable hardware. Rather than focusing on specific industrial sectors, the campaign casts a wide net based primarily on product type and geographical location. Stated geographic preferences for the actor include the United States and Canada, followed by European countries and selected Asia Pacific markets.
Geographic distribution of the observed compromises shows heavy concentration outside North America. Nearly 38% of identified victims reside in the Asia Pacific region, followed by 31.9% in Latin America, 15.8% in Europe, and 12.7% situated across the Middle East and North Africa. The peak period of compromise occurred between February and June 2026, an active window that partially overlaps with a separate credential harvesting operation known as FortiBleed.
The multi-stage attack chain begins with exploitation attempts against known software vulnerabilities, including CVE-2025-64446—a path traversal flaw impacting FortiWeb—and CVE-2026-0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS and Prisma Access. Operators deploy custom Python scripts, specifically named fortnew.py and exploit_2026_0257.py, alongside aggressive brute-force attacks utilizing common username and password combinations to establish initial entry.
Once inside the perimeter, the threat actor establishes a foothold via OpenConnect VPN connections. Post-exploitation activities involve extensive internal credential theft and network enumeration, targeting Active Directory environments, Server Message Block protocols, and installed antivirus software. To maintain persistent access, operators deploy legitimate remote administration tools such as MeshCentral Agent, Atera, Teramind, and AnyDesk, alongside the open-source adversary-emulation framework AdaptixC2.
Lateral movement within corporate networks is facilitated through standard administrative and penetration testing utilities. Attackers utilize tools like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into enterprise architectures. For data exfiltration, the campaign relies on Rclone to siphon harvested records into Wasabi S3 buckets and MEGA cloud storage drives.
The operation has yielded more than 70,000 exposed credentials, comprising network device logins and Lightweight Directory Access Protocol dumps. Investigators noted that many of the organizations compromised in this campaign subsequently appeared on the extortion and data leak sites operated by the Qilin and The Gentlemen ransomware gangs, though the exact contractual nature of these affiliations remains undetermined.
While the campaign shares temporal overlap with the FortiBleed activity cluster, researchers identified only a negligible overlap in compromised data sets between the two campaigns. This divergence suggests that the current operation represents a separate dataset, a distinct subset of operators, or a related access initiative operating parallel to broader FortiBleed infrastructure. Security professionals advise organizations to immediately audit network perimeters and apply patches for all referenced vulnerabilities.
