70,000 Credentials Later: How One Access Broker Turned Exposed Firewalls and VPN Portals Into a Pipeline for Ransomware Crews
Researchers at Group-IB and NyxLab have traced a campaign by an actor called k0t that scanned for exposed FortiGate, FortiWeb and GlobalProtect devices at scale, broke in with old flaws and weak passwords, and left behind remote access tools. Many victims later turned up on ransomware leak sites. Here is the attack, stage by stage.
Most companies picture an attacker picking them out by name. A new investigation shows the opposite. A threat actor known as k0t chose victims by the model of firewall or VPN box they had facing the internet, not by industry or size. If the device was reachable and weak, the company behind it was on the list.
This walkthrough draws on The Hacker News’ coverage of the joint investigation by Group-IB and NyxLab, published October 21.
Who is k0t?
The researchers say the actor, who also uses the names CryptoFeel, Member19 and QazWsxShop, was first seen in October 2025. Many organizations hit in the campaign were later listed on the leak sites of the Qilin and The Gentlemen ransomware groups, which points to k0t working as an initial access broker or affiliate. The researchers stress that the exact relationship is not confirmed. They also found more than 70,000 exposed credentials tied to network devices and LDAP directory dumps, with negligible overlap with an earlier credential-harvesting campaign known as FortiBleed.
The attack, stage by stage
- Shopping for targets. The operators used internet search engines for exposed devices, such as FOFA and ZoomEye, to list reachable VPN and firewall appliances in bulk and filter them by product.
- Getting in. They tried known flaws, including CVE-2025-64446 in Fortinet FortiWeb and CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect, using their own scripts. Where no flaw worked, they tried common username and password combinations against the device.
- Harvesting the box. On compromised firewalls they pulled stored credentials, which according to Group-IB can include directory and administrator accounts.
- Walking in the front door. With working credentials they connected to the victim network over an ordinary VPN client, so their sessions looked like remote staff.
- Looking around. Inside, they mapped Active Directory, file shares and the installed antivirus, using common admin and penetration testing tools such as NetExec, Impacket, Kerbrute and Mimikatz.
- Staying put. They installed legitimate remote management tools, including MeshCentral agents, Atera and AnyDesk, plus an open-source command-and-control framework, so they could return even if a password changed.
- Taking the data. Files were copied out with Rclone to cloud storage accounts on Wasabi and MEGA.
Where the victims are
Much of the activity took place between February and June 2026. About 38% of victims were in Asia Pacific, followed by Latin America, Europe and the Middle East and North Africa. The researchers note that k0t’s own stated priorities start with the United States and Canada, so a low U.S. share in this data set is no reason to relax.
What this means for your company
Every step here relied on something ordinary: a device left reachable, an old patch skipped, a guessable password or a remote access tool nobody was watching. Check that your firewall and VPN firmware is current, that no default or shared admin passwords remain, and that VPN logins require multifactor authentication. If a device ran an unpatched version this year, rotate the accounts stored on it, including directory service accounts. Finally, keep an inventory of the remote management tools you actually use, and alert on any new one that appears.
Need help checking your firewall and VPN exposure before an access broker finds it first? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
