Researchers have disclosed a large-scale Fortinet Palo Alto Firewall Breach campaign that targeted exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect systems and left more than 70,000 exposed credentials tied to the operation. The joint investigation by Group-IB and NyxLab says the activity reached organizations around the world and, in some cases, led to persistent remote access and data exfiltration.
The report lands at a moment when enterprise edge devices remain a favorite route into corporate networks, and this campaign was not limited to one industry or one country. The researchers said a significant share of the compromises happened between February and June 2026, with nearly 38% of victims in Asia Pacific, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa.
At the center of the operation is an actor tracked as k0t, a name also tied to CryptoFeel, Member19 and QazWsxShop. Group-IB and NyxLab said k0t first surfaced in the wild on Oct. 22, 2025 and appears connected to ransomware groups including Qilin and The Gentlemen. The researchers said the operator relies on legitimate administrator and pentesting utilities such as NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz to move deeper once a device is exposed.
That method matters because the campaign appears to favor exposed appliances over individual targets. The researchers said k0t enumerates network appliances at scale, then focuses on the product and location of the exposed device more than the victim's industry. They also said the actor's geographic priorities begin with the United States and Canada, followed by European countries and selected APAC markets.
There is one unresolved wrinkle. Group-IB and NyxLab said the activity overlaps in time with FortiBleed, but the overlap in compromised data was negligible. That leaves open whether this is a separate dataset, an operator subset or a related access operation within the same wider cluster, even as the exposed credentials tied to the campaign keep piling up.
For organizations that run exposed Fortinet and Palo Alto gear, the message is blunt: the device on the edge is no longer just a perimeter box, it is an entry point. The next step is to remediate the vulnerabilities referenced in the report and check for signs that legitimate tools were used to stay inside.
