Critical Fortinet, Palo Alto Networks flaws let hackers steal credentials

Key Takeaways

• A threat actor identified as “k0t” is actively targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices.
• The campaign aims to steal credentials and establish persistent access to corporate networks by exploiting known vulnerabilities and weak credentials.
• More than 70,000 exposed credentials, including network device and LDAP records, have been identified, though not all indicate successful compromise.
• Affected organizations span diverse industries and regions, highlighting the broad nature of the attacks.
• Patches are available for the exploited vulnerabilities, and immediate action is required to secure vulnerable systems and mitigate potential post-compromise lateral movement.

Widespread Credential Theft Campaign Targets Network Edge Devices

A persistent cyber campaign, attributed to an operator known as “k0t,” is actively exploiting critical vulnerabilities and weak configurations in internet-facing firewall and VPN systems from Fortinet and Palo Alto Networks. The primary objective is to exfiltrate credentials and secure long-term access to victim organizations’ internal networks. Once initial access is achieved, attackers can harvest passwords embedded within device configurations, facilitating deeper penetration into the compromised infrastructure. This ongoing activity was detailed in a report published on October 21, 2026, by Analysts from Group-IB, working with NyxLab, identified this sophisticated operation.

The investigation uncovered over 70,000 exposed credentials and associated data, encompassing network device credentials and LDAP records. It is important to note that while these credentials were exposed, this figure does not confirm that every instance resulted in a successful network compromise. The campaign has impacted organizations across various sectors and geographical locations, indicating a broad, indiscriminate approach rather than a targeted industry focus.

Exploitation of Fortinet and Palo Alto Networks Vulnerabilities

The attackers leverage public search services to identify vulnerable VPN portals and firewalls exposed to the internet. They then systematically probe these systems for weaknesses, employing a combination of exploiting known software flaws and brute-forcing common or weak credentials to gain unauthorized entry.

FortiWeb devices are specifically targeted using CVE-2025-64446, an improper access control vulnerability that allows an unauthenticated attacker to execute arbitrary administrative commands through specially crafted web requests. Group-IB observed a custom tool deployed by the attackers to exploit this flaw and create new administrator accounts. FortiGate devices, while not susceptible to this particular FortiWeb vulnerability, are subjected to dictionary attacks and credential stuffing attempts.

The compromise of FortiGate devices extends beyond the immediate firewall. Attackers are able to download device configuration files, which often contain sensitive credentials, including administrator account details and credentials for LDAP or Active Directory integration. Group-IB highlighted that the attackers utilized a publicly known default encryption key to decrypt some of these stored secrets. This emphasizes that a compromised configuration file should be treated as a potential disclosure of critical passwords, not merely a device management issue.

Palo Alto Networks GlobalProtect systems are also under attack, with observed attempts to exploit CVE-2026-0257. This authentication bypass vulnerability affects GlobalProtect portals and gateways configured with specific PAN-OS settings, enabling unauthorized VPN connections. Palo Alto Networks has issued an advisory detailing this risk and providing remediation guidance. Previous reports have also highlighted the exploitation of FortiWeb flaws and the release of exploit tools, underscoring the ongoing threat to these network-edge devices.

Post-Compromise Activities and Lateral Movement

Once inside a victim’s network, the threat actors utilize a range of legitimate administration and security tools to conduct reconnaissance, discover additional systems, and escalate privileges. Group-IB documented the use of tools such as NetExec, Impacket, and Mimikatz. For persistent remote access, attackers deploy software like MeshCentral and Atera. The use of these legitimate tools makes detection challenging, as their presence might be mistaken for normal IT operations if not correlated with other suspicious activities.

The researchers identified 28 active device groups, comprising 84 compromised devices, linked to a MeshCentral server. Evidence of other remote-access tools and a command-and-control framework was also uncovered. In some instances, data was exfiltrated to cloud storage services using Rclone. While Group-IB noted that some victims subsequently appeared on ransomware leak sites, a direct affiliation between k0t and the ransomware groups has not been confirmed.

What You Should Do

• Patch Immediately: Ensure all FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect systems are updated to the latest patched versions to address CVE-2025-64446 and CVE-2026-0257.
• Restrict Administrative Access: Limit administrative access to network-edge devices to trusted networks and implement strict access controls.
• Review and Rotate Credentials: If a device is suspected of compromise, immediately rotate all credentials stored on or linked to the appliance, including administrator accounts and credentials for integrated services like LDAP or Active Directory.
• Monitor Logs: Regularly review logs for unusual administrator accounts, unexpected configuration exports, suspicious VPN sessions, repeated login failures, and management access attempts from unfamiliar IP addresses or locations.
• Enable Custom Encryption Keys: For FortiGate administrators, verify that private data encryption is enabled and configured with an organization-controlled key, rather than relying on default keys.
• Holistic Threat Hunting: Correlate logs from network appliances, VPN services, identity providers, and endpoint detection and response (EDR) systems to identify subtle indicators of compromise that might be missed in isolated reviews.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.