Cybersecurity
Researchers say firewall campaign exposed 70,000 credentials
Group-IB and NyxLab said a campaign against exposed Fortinet and Palo Alto devices led to persistent access, data theft and more than 70,000 credentials linked to the activity.
- Group-IB and NyxLab said a campaign targeted exposed edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect.
- They attributed the activity to k0t, also called CryptoFeel, Member19 and QazWsxShop, and said it first appeared on 22 October 2025.
- The researchers said the operators scanned with FOFA and ZoomEye, tried exploits or password guessing, then used OpenConnect, persistence tools and Rclone for exfiltration.
- They said they had identified more than 70,000 exposed credentials linked to the activity, found little overlap with FortiBleed and saw the largest share of victims in Asia Pacific.
Group-IB and NyxLab published a joint account of a campaign against internet-facing network devices. They said Fortinet FortiGate and Palo Alto Networks GlobalProtect appliances had been among the targets, and that some victims ended up with persistent access and data theft.
The report attributed the activity to k0t, who also used the names CryptoFeel, Member19 and QazWsxShop. The researchers said the actor first appeared on 22 October 2025 and assessed links to Qilin and The Gentlemen, while describing the role as likely that of an initial access broker or affiliate.
According to the report, the operators began by scanning with FOFA and ZoomEye and then tried to break in with scripts or password guessing. After access, they used OpenConnect, checked for Active Directory, SMB and antivirus data, and kept hold of systems with remote administration tools and AdaptixC2.
They said data was then sent out with Rclone to Wasabi S3 and MEGA. Group-IB and NyxLab said they had found more than 70,000 exposed credentials linked to the campaign and reported little overlap with FortiBleed; they also said victim locations were spread across regions, with the largest share in Asia Pacific.
Named in this story
People
- k0t
- was attributed to the campaign and used the aliases CryptoFeel, Member19 and QazWsxShop
Companies
- Wasabi
- provided S3 storage for exfiltration
- MEGA
- provided cloud storage for exfiltration
Organisations
- Group-IB
- co-published the investigation
- NyxLab
- co-published the investigation
- Qilin
- was cited as a ransomware group linked to the actor
- The Gentlemen
- was cited as a ransomware group linked to the actor
Products and systems
- Fortinet FortiGate
- was among the exposed firewall devices targeted
- Palo Alto Networks GlobalProtect
- was among the exposed VPN devices targeted
- FortiWeb
- was named in an exploited vulnerability
- PAN-OS
- was named in an exploited vulnerability
- Prisma Access
- was named in an exploited vulnerability
- FOFA
- was used to scan for internet-facing devices
- ZoomEye
- was used to scan for internet-facing devices
- OpenConnect
- was used to establish access to targets
- MeshCentral Agent
- was used to maintain persistence
- Atera
- was used to maintain persistence
- AdaptixC2
- was used to maintain persistence and control
- Rclone
- was used to move data out
- Mimikatz
- was used after compromise to steal credentials
How the source tells it
The article read like a threat-intelligence bulletin, with alarm at scale and urgency built from broad victim counts and a final push to remediate.
- alarm at scale broad impact claims and a 70,000-credential count made the campaign sound extensive
- urgency the closing remediation advice pushed immediate action