k0t Campaign Exploits Fortinet and Palo Alto Edge Devices, Exposing 70,000+ Credentials

Group-IB and NyxLab have disclosed a campaign by a threat actor known as k0t that scans for internet-exposed Fortinet and Palo Alto Networks edge appliances and then breaches them. The intrusions rely on exploits for CVE-2025-64446 and CVE-2026-0257, or on brute-forced logins where exploits fail. More than 70,000 credentials tied to firewalls, VPN gateways and LDAP directories have been exposed, and some victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups. Targeting is driven by product and geography rather than industry, with North America, Europe and parts of APAC named as priorities. Defenders are advised to apply the vendors' patches, rotate credentials on exposed devices and directory services, and enforce MFA on VPN access.