k0t access broker breaks into edge devices and harvests directory credentials
Group-IB and NyxLab reported on October 21, 2026 that k0t got into edge devices through the FortiWeb flaw CVE-2025-64446, the PAN-OS GlobalProtect authentication bypass CVE-2026-0257, or brute force against FortiGate REST APIs, with many FortiGate compromises dated February to June 2026. It decrypted downloaded FortiGate configurations with the FortiOS default key weakness CVE-2019-6693 to recover LDAP and Active Directory bind, admin and local user credentials, then used noPac to reach Domain Admin. Victims later appeared on Qilin and The Gentlemen leak sites; a direct affiliation is unconfirmed.
- Victim
- Multiple: organizations running exposed FortiWeb, FortiGate and PAN-OS GlobalProtect devices
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Feb 2026
- First disclosed
- Oct 21, 2026
- Actor
- k0t, a likely initial access broker (per Group-IB and NyxLab) (Financially motivated)
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Credential storage
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Firewall configurations held directory bind credentials protected by a default key. Low-privilege bind accounts, configuration encryption with an organization-owned key, and rotating every credential on an appliance after exposure would have cut the path from the edge to the domain.
Go deeper on SWI
- Vulnerability: FortiWeb auth bypass and path traversal, admin creation
- Vulnerability: PAN-OS GlobalProtect accepts forged authentication override cookies
- Product involved: Palo Alto Prisma Access
- SWI coverage: access broker k0t breached fortigate and globalprotect and exposed 70000 credentials
Sources
- Stray Cat, Open Doors: How k0t Wanders Through the Network Edge, Group-IB, Oct 21, 2026
Record verified Nov 5, 2026 against the sources above. Corrections: contact us.
Related incidents
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
- Pulse Connect Secure VPN exploitation and credential harvesting 2021 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). k0t access broker breaks into edge devices and harvests directory credentials. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-k0t-edge-device-access-broker/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.