# Access broker k0t breached FortiGate and GlobalProtect edges and exposed more than 70,000 credentials

Source: https://startwithidentity.com/blog/2026-10-21-access-broker-k0t-breached-fortigate-and-globalprotect-and-exposed-70000-credentials/
Last updated: 2026-10-21
License: content by Start with Identity. Cite the source URL.

---

Group-IB and NyxLab published research on October 21 on k0t, which they assess as a likely initial access broker with unconfirmed links to the Qilin and The Gentlemen ransomware groups. The actor found exposed edge devices through FOFA and ZoomEye, then got in with CVE-2025-64446 in FortiWeb to create a rogue admin, the CVE-2026-0257 GlobalProtect authentication bypass in [Palo Alto Networks](https://startwithidentity.com/vendors/zero-trust/palo-alto/) PAN-OS, or brute force against the FortiGate REST API that paused on lockouts and retried. It decrypted downloaded FortiGate configuration files using the FortiOS default key weakness CVE-2019-6693, escalated to Domain Admin with noPac (CVE-2021-42278 and CVE-2021-42287), and exfiltrated with Rclone. The researchers counted more than 70,000 exposed credentials tied to network devices and LDAP dumps. Many compromises fell between February and June 2026.

## Why it matters

A firewall config is a credential store. FortiGate configs carry LDAP and Active Directory bind accounts, admin accounts and local users, so one stolen file hands over directory credentials without touching a domain controller. The research recommends treating any exposed config as a credential disclosure event.

Rotate every credential stored on affected appliances, starting with LDAP bind and privileged accounts, and make bind accounts low-privilege. Enable FortiGate `private-data-encryption` with your own key. Take management interfaces off the internet, patch the three edge CVEs (our brief on [CVE-2025-64446](https://startwithidentity.com/cves/cve-2025-64446/) has the FortiWeb details), replace common passwords, and investigate repeated lockouts as [password spraying](https://startwithidentity.com/techniques/password-spraying/). Our October 19 post covers [Qilin and INC's use of the GlobalProtect bypass](https://startwithidentity.com/blog/2026-10-19-qilin-and-inc-use-globalprotect-auth-bypass-to-skip-mfa-and-dump-dc-disks/).

Source: [Group-IB](https://www.group-ib.com/blog/stray-cat-network-edge/)