Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally

• •Over 70,000 credentials compromised from multiple global organizations.
• •Exploited vulnerabilities include CVE-2025-64446 and CVE-2026-0257.
• •The threat actor k0t is linked to ransomware groups and uses advanced exploitation techniques.

A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000 credentials. The threat actor, known as k0t, has been active since October 2025 and is linked to ransomware groups like Qilin and The Gentlemen. The attack method involves exploiting vulnerabilities such as CVE-2025-64446 and CVE-2026-0257, using custom scripts and brute-force techniques to gain access. Victims are spread across various sectors worldwide, with significant concentrations in the Asia Pacific and Latin America. The campaign has been characterized by persistent remote access and data exfiltration, with operations continuing through mid-2026. The investigation by Group-IB and NyxLab indicates that the campaign may be connected to earlier credential harvesting efforts known as FortiBleed.