NexusSec.Firewalls and VPN portals hold more than rules. Their configurations often include the passwords they use to talk to Active Directory, and that is what this campaign was after. This post reflects what was published up to 1 November 2026.
What happened
Group-IB's threat intelligence team and NyxLab published research on 21 October 2026 about k0t, which they describe as a collaborative operation targeting edge devices at scale. The operators found targets through public internet scanners and lists from underground sources, with little regard for industry. The researchers say the campaign exposed more than 70,000 credentials, including network device credentials and LDAP dumps.
How they got in
- Fortinet FortiWeb: CVE-2025-64446, a path traversal flaw, used to impersonate an administrator profile and create a new local administrator.
- Fortinet FortiGate: not through that flaw, but by brute-forcing the REST API with common usernames and passwords.
- Palo Alto GlobalProtect: CVE-2026-0257, an authentication bypass in certain configurations, using forged authentication-override cookies to open a VPN session.
Once inside, they decrypted configuration files offline using FortiOS's default encryption key, a long-known weakness tracked as CVE-2019-6693, to recover LDAP and Active Directory bind credentials and administrator passwords. From there they used common attack tools to dump credentials, gain domain administrator rights and move through networks, installed remote-management tools to stay in, and copied data out to cloud storage.
Group-IB says victims overlap with those of the Qilin and The Gentlemen ransomware groups, which suggests k0t may sell access to others, although it says any direct link is unconfirmed.
What to do
- Patch internet-facing firewalls, WAFs and VPN portals, including FortiWeb for CVE-2025-64446 and PAN-OS for CVE-2026-0257.
- Take management interfaces and APIs off the internet. Reach them only from trusted admin networks or through a VPN.
- On FortiGate, enable private-data-encryption, so configurations are not protected only by the default key.
- Treat any exposed configuration as a credential leak: rotate every credential it contains, including LDAP bind and service accounts, and use a low-privilege account for LDAP binds.
- Remove default and common passwords, increase lockout times and investigate repeated failed logins.
- Enforce MFA on VPN and administrator access. See where to start with MFA.
- Watch for unexpected VPN sessions and remote-management tools such as AnyDesk, Atera, MeshCentral or ngrok that you did not install.
CERT-In also published an advisory on multiple vulnerabilities in Fortinet products on 24 October 2026; check it against your models and versions. Our firewall audit checklist covers admin access, exposed services and VPN settings in more detail.
