INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers Breach Enterprise Firewalls and VPNs Exposing Over 70,000

| 2026-10-23 13:50 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A large-scale campaign targeting exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls was disclosed by cybersecurity researchers on October 23, 2026. The threat actor behind the attack is assessed to be k0t, who also goes by aliases CryptoFeel, Member19, and QazWsxShop, and shares connections with ransomware groups such as Qilin and The Gentlemen. Over 70,000 credentials were exposed in the breach, affecting victims from over 100 countries worldwide, with nearly 38% concentrated in Asia Pacific, followed by Latin America, Europe, and the Middle East and North Africa. The attack chain involves reconnaissance through public scanning tools to enumerate internet-facing VPN and firewall appliances, exploitation via known vulnerabilities or brute-force attacks, establishing a foothold on targets via OpenConnect VPN connections, conducting post-exploitation actions, and exfiltrating harvested data using legitimate remote access tools.
Technical Mitigations AI-generated
• Patch FortiWeb and Palo Alto Networks PAN-OS and Prisma Access using CVE-2025-64446 and CVE-2026-0257 patches. • Monitor for brute-force attacks using common username and password combinations, such as those listed in the MITRE ATT&CK framework's "Brute Force" technique. • Block or hunt for OpenConnect VPN connections to prevent initial access establishment.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
ex•••••.py
fo•••••.py
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
The GentlemenThe Gentlemen QilinQilin CVE-2026-0257CVE-2026-0257 CVE-2025-64446CVE-2025-64446
Target & Sectors
LATAM LATAM EUROPE EUROPE NORTH_AMERICA NORTH_AMERICA APAC APAC MENA MENA AFRICA AFRICA
Incident Timeline
‎October 22, 2025
Threat actors purchased vulnerability exploit code and premium accounts for metadata search engines like FOFa and ZoomEye, indicating a keen interest in acquiring tools to target enterprise firewalls and VPNs.
threat_actor The Gentlemen
The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate.
organisation FOFA
Analysis of the threat actor's dark web activity reveals a keen interest in purchasing vulnerability exploit code and tools or premium accounts for metadata search engines like FOFA and ZoomEye .
‎June 2026
Threat actors used a combination of legitimate remote access tools and open-source adversary-emulation frameworks to establish persistence on compromised hosts, exfiltrate harvested data via cloud storage services.
threat_actor The Gentlemen
" k0t's links to Qilin and The Gentlemen stem from the fact that many victims of the campaign were also later listed by the ransomware groups on their data leak sites.
organisation Attempt
Attempt to exploit these devices via known vulnerabilities like CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.
organisation Prisma Access
Attempt to exploit these devices via known vulnerabilities like CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.
organisation NetExec
The attacks are also characterized by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims' corporate environments.
organisation SoftPerfect
The attacks are also characterized by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims' corporate environments.
organisation PetitPotam
The attacks are also characterized by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims' corporate environments.
data_breach 70,000 Credentials
More than 70,000 exposed credentials associated with network devices and LDAP dumps have been identified in connection with the campaign.
organisation OpenConnect
Establish a foothold on the targets via an OpenConnect VPN connection.
organisation SMB
Conduct post-exploitation actions and additional credential theft like enumeration of Active Directory, SMB, and installed antivirus solution.
organisation MeshCentral
Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2 .
organisation Atera, Teramind
Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2 .
organisation AnyDes
Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2 .
organisation Rclone
Exfiltrate harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.
organisation Wasabi S3
Exfiltrate harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.
organisation NyxLab
What's more, Group-IB and NyxLab said they found a "negligible overlap" in compromised data between this activity and FortBleed.
organisation FortBleed
What's more, Group-IB and NyxLab said they found a "negligible overlap" in compromised data between this activity and FortBleed.
organisation FortiBleed
"This aligns with reports that many operators are likely to be involved in the FortiBleed activity cluster, suggesting that this may be a separate dataset, operator subset, or related access operation within the broader FortiBleed-related activity," the researchers said.
‎Oct 23, 2026
Threat actors attributed to the alias k0t exploited vulnerabilities in enterprise firewalls and VPNs, exposing over 70,000 credentials.
organisation Group-IB
"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration," according to a joint investigation published by Group-IB and NyxLab.
organisation k0
The widespread exploitation activity has been attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop.
‎between February and June 2026
Threat actors breached enterprise firewalls and VPNs between February and June 2026, coinciding with another credential harvesting campaign codenamed FortiBleed.
‎2026/10/23
Hackers used unpatched Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls to breach enterprise networks, exposing over 70,000 credentials.
infrastructure Fortigate
 Ravie Lakshmanan  Oct 23, 2026 Vulnerability / Cyber Attack Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
organisation Vulnerability / Cyber Attack Cybersecurity
 Ravie Lakshmanan  Oct 23, 2026 Vulnerability / Cyber Attack Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
organisation Fortinet FortiGate
 Ravie Lakshmanan  Oct 23, 2026 Vulnerability / Cyber Attack Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
organisation Palo Alto Networks GlobalProtect
 Ravie Lakshmanan  Oct 23, 2026 Vulnerability / Cyber Attack Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
organisation Hackers Breach Enterprise Firewalls
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials.
data_breach 70,000 Credentials
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials.
Tactical Metrics
Metrics
infrastructure
‎Fortigate
Affected Product
 Ravie Lakshmanan  Oct 23, 2026 Vulnerability / Cyber Attack Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
Metrics
data_breach
70,000
Credentials
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials.
More than 70,000 exposed credentials associated with network devices and LDAP dumps have been identified in connection with the campaign.
Intelligence Sources
The Hacker News 2026-10-23