Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Researchers at Group-IB and NyxLab have uncovered a widespread campaign in which a threat actor dubbed k0t has been breaching internet-facing firewalls and VPN appliances, including Fortinet FortiGate and Palo Alto Networks GlobalProtect devices. The attacker, active since October 22, 2025 and also known under aliases such as CryptoFeel, Member19 and QazWsxShop, scans for exposed targets using tools like FOFA and ZoomEye before exploiting flaws such as CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS/Prisma Access, or brute-forcing credentials, to gain a foothold via OpenConnect VPN. From there, k0t harvests Active Directory and SMB data, deploys remote-access tools like MeshCentral, Atera, Teramind, AnyDesk and AdaptixC2, and exfiltrates stolen information through Rclone to Wasabi S3 and MEGA. The operation, believed to have links to the Qilin and The Gentlemen ransomware gangs, has already exposed more than 70,000 credentials and victim records worldwide, with organizations urged to patch the named vulnerabilities promptly.