The Hackers Who Log In Through the Firewall

The box sold to keep attackers out is now how they get in. A crew called k0t has been finding internet-facing Fortinet and Palo Alto firewalls, getting in with guessed passwords or one of two known exploits, and then opening a normal VPN session into the network behind them.

Researchers at Group-IB and NyxLab published the campaign on October 21, 2026. They counted more than 70,000 exposed credentials tied to network devices and LDAP dumps, and many victims later showed up on the leak sites of the Qilin and The Gentlemen ransomware gangs. If you manage firewalls for clients, this one is about your fleet.

TL;DR

• What happened: Group-IB and NyxLab say the k0t crew broke into FortiGate, FortiWeb and Palo Alto GlobalProtect devices and exposed 70,000+ credentials, many of them Active Directory (LDAP) logins.
• Am I exposed? A client is at risk if its firewall admin page faces the internet with a guessable password, its FortiWeb is unpatched for CVE-2025-64446, or its GlobalProtect is unpatched for CVE-2026-0257.
• What to do: Preserve logs, look for strange admin logins and accounts, patch, take management pages off the internet, and change every password stored in the firewall's config.
• Impact: The Hacker News reports k0t likely sells access to or works with Qilin and The Gentlemen, so a firewall break-in can turn into ransomware.

What is the k0t campaign?

The k0t campaign is a run of break-ins aimed at edge devices: the firewalls and VPN gateways that sit between a company's network and the internet. Group-IB's report names k0t as the probable main operator, says CryptoFeel may be another alias, and says several people seem to be involved. [The Hacker News](https://thehackernews.com/