Access broker k0t breached FortiGate and GlobalProtect edges and exposed more than 70,000 credentials

Group-IB and NyxLab published research on October 21 on k0t, which they assess as a likely initial access broker with unconfirmed links to the Qilin and The Gentlemen ransomware groups. The actor found exposed edge devices through FOFA and ZoomEye, then got in with CVE-2025-64446 in FortiWeb to create a rogue admin, the CVE-2026-0257 GlobalProtect authentication bypass in Palo Alto Networks PAN-OS, or brute force against the FortiGate REST API that paused on lockouts and retried. It decrypted downloaded FortiGate configuration files using the FortiOS default key weakness CVE-2019-6693, escalated to Domain Admin with noPac (CVE-2021-42278 and CVE-2021-42287), and exfiltrated with Rclone. The researchers counted more than 70,000 exposed credentials tied to network devices and LDAP dumps. Many compromises fell between February and June 2026.

Why it matters

A firewall config is a credential store. FortiGate configs carry LDAP and Active Directory bind accounts, admin accounts and local users, so one stolen file hands over directory credentials without touching a domain controller. The research recommends treating any exposed config as a credential disclosure event.

Rotate every credential stored on affected appliances, starting with LDAP bind and privileged accounts, and make bind accounts low-privilege. Enable FortiGate private-data-encryption with your own key. Take management interfaces off the internet, patch the three edge CVEs (our brief on CVE-2025-64446 has the FortiWeb details), replace common passwords, and investigate repeated lockouts as password spraying. Our October 19 post covers Qilin and INC's use of the GlobalProtect bypass.

Source: Group-IB