Threat-intelligence firm Group-IB and its partner NyxLab published a joint investigation on Oct. 21, 2026 into a threat actor they track as k0t. Their report says the crew is breaking into internet-facing Fortinet FortiGate firewalls, FortiWeb web application firewalls, and Palo Alto Networks GlobalProtect VPN portals at scale, harvesting the passwords stored on them, and using that access to get deeper into company networks. Group-IB says it found more than 70,000 exposed credentials tied to network devices and directory dumps in the operators' data.
We are not aware of any dental or medical practice in our area named in this report. We're covering it because these devices are common at the front door of small practices, clinics, and plants, and the fixes are short.
How k0t gets in, according to Group-IB
Group-IB says k0t doesn't research individual targets. The operators pull bulk lists of exposed firewalls and VPN portals from internet search engines such as FOFA and ZoomEye, then run automated tools against every address. In Group-IB's words, the product and location of an exposed device "appear to matter more than the industry of the organization operating it." Group-IB says k0t's stated geographic priorities begin with the United States and Canada.
- FortiWeb (CVE-2025-64446): a path-traversal flaw that lets an unauthenticated attacker run administrative commands. Group-IB says k0t's script uses it to create a new local administrator that can log in from any address.
- FortiGate (password guessing): FortiGate isn't vulnerable to that FortiWeb bug, so the script falls back to brute force with common usernames and passwords such as "admin," "fortinet," and "fortigate." Group-IB notes the tool waits out FortiGate's default 60-second lockout, then tries again.
- GlobalProtect (CVE-2026-0257): an authentication bypass on vulnerable PAN-OS configurations that use authentication-override cookies. Group-IB says the operators forge a cookie and then open a VPN session into the network.
Both CVEs are in CISA's Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-64446 since November 2025 and CVE-2026-0257 since May 2026. KEV marks CVE-2026-0257 as known to be used in ransomware campaigns.
The password problem inside the firewall
Once in, Group-IB says, the tool downloads the FortiGate configuration file and decrypts its stored secrets offline using FortiOS's default encryption key, a known weakness tracked as CVE-2019-6693 (in KEV since June 2025 and marked as used in ransomware). That recovers the LDAP and Active Directory accounts the firewall uses to check logins, plus local user accounts and, Group-IB says, administrator credentials. The fix is a FortiGate setting called private-data-encryption with your own key. If it was never turned on, the device falls back to the publicly known key.
Because the decryption happens on the attacker's copy, nothing on the firewall would show it. The report says to treat an exposed FortiGate configuration "as a credential disclosure event, not only as an appliance compromise."
What happens next
The report describes hands-on-keyboard intrusions after the firewall: credential theft with tools such as NetExec, Impacket, and Mimikatz, attempts to reach domain-administrator control, and persistence through remote-management software including MeshCentral, Atera, AnyDesk, and ngrok. Data was pulled out with Rclone to cloud storage. Group-IB counted 84 compromised devices on one k0t control server at the time of analysis. Group-IB also says many victims were later listed by the Qilin and The Gentlemen ransomware groups, and assesses that k0t likely acts as an initial access broker. It says any direct affiliation is still unconfirmed.
Why it matters to dental, medical, and industrial offices
In a dental or medical office, the firewall sits in front of the practice-management system, imaging, e-prescribing, and the VPN the doctor uses from home. The Active Directory account stored on it often has broad read access to the whole network. In a shop or plant, the same box carries vendor remote access and accounting. Because k0t picks targets by device, not by industry, an office that has never thought of itself as a target is in scope if its firewall login page is reachable from the internet.
Clear takeaway
If your office runs a FortiGate, FortiWeb, or Palo Alto GlobalProtect device, take this week to confirm it's patched, its admin login isn't on the open internet, no default or common password is in use, private-data-encryption is on, and the directory accounts it stores have been rotated.
Actions to take this week
- Find your edge devices. List every firewall, VPN, and web application firewall with its firmware version. Ask your IT provider in writing if you don't know.
- Patch FortiWeb against CVE-2025-64446 and PAN-OS GlobalProtect against CVE-2026-0257, following each vendor's advisory.
- Take admin pages off the internet. Allow firewall management only from inside the office or over an existing VPN, as Group-IB recommends.
- Kill default and common passwords on every admin and VPN account, lengthen the lockout time, and have someone look into repeated lockouts instead of ignoring them.
- Turn on private-data-encryption on FortiGate with your own key, then rotate every credential the configuration holds, starting with LDAP and Active Directory bind accounts. Use a dedicated low-privilege bind account, not a domain admin.
- Require MFA on VPN and remote access, and review installed remote-support tools. Remove any MeshCentral, Atera, AnyDesk, or ngrok install nobody can explain.
Brotherly Technology helps dental and medical practices, manufacturers, and professional offices across Rome, Northwest Georgia, Atlanta, Chattanooga, and the Southeast check firewalls and VPNs against reports like this one. If you'd like a short edge-device review before someone else's scanner finds yours, give us a call.
Sources:
- Group-IB and NyxLab: "Stray Cat, Open Doors: How k0t Wanders Through the Network Edge" (Oct. 21, 2026). Source for the campaign details, figures, ransomware-group overlaps, and recommendations.
- CISA Known Exploited Vulnerabilities catalog. CVE-2025-64446 (Fortinet FortiWeb, added 2025-11-14), CVE-2026-0257 (Palo Alto Networks PAN-OS, added 2026-05-29), CVE-2019-6693 (Fortinet FortiOS, added 2025-06-25).