k0t Access Broker Exposes 70,000 FortiGate and GlobalProtect Credentials: Verify Your Exposure Now

k0t is the Group-IB designation for a suspected initial access broker who systematically harvests credentials from internet-facing network security appliances and sells the resulting access to ransomware affiliates. The campaign disclosed on October 21, 2026, represents k0t's broadest documented operation: more than 70,000 credential entries and LDAP dumps sourced from FortiGate firewalls, FortiWeb web application firewalls, and Palo Alto Networks GlobalProtect VPN gateways.

The operation follows a repeatable three-phase methodology. In the reconnaissance phase, k0t used FOFA (a Chinese internet asset intelligence engine) and ZoomEye to enumerate internet-facing appliances matching FortiGate, FortiWeb, and GlobalProtect fingerprints. These tools return device IP addresses, firmware version banners, and open service metadata that allow the actor to triage targets by patch level and geography before touching any device.

In the exploitation phase, k0t used two CVEs against unpatched systems. Against FortiWeb, the actor applied CVE-2025-64446, an unauthenticated remote code execution vulnerability that allows direct shell access without valid credentials. Against GlobalProtect, k0t exploited CVE-2026-0257, a PAN-OS authentication bypass (CISA KEV-listed) that lets an unauthenticated attacker authenticate to the VPN portal as a valid user. FortiGate devices without either CVE were subjected to credential brute force using common default and commonly reused passwords.

In the post-compromise phase, k0t moved from device credentials to domain credentials. The actor ran NetExec to enumerate Windows hosts reachable from the compromised network device, used Impacket libraries for pass-the-hash and Kerberos attacks, and deployed Mimikatz to extract plaintext credentials and NTLM hashes from memory on domain-connected hosts. For persistence, k0t installed MeshCentral and Atera RMM agents on accessed Windows servers, creating durable remote access that survived credential rotation on the perimeter device.

The result is a two-layer credential package: perimeter device credentials (FortiGate admin accounts, GlobalProtect user accounts) and internal directory credentials (Active Directory usernames, hashes, and in some cases plaintext passwords) that ransomware operators can use to bypass the perimeter entirely and move directly to domain admin escalation.

Group-IB's dataset of more than 70,000 records understates the total exposure from k0t-adjacent activity when FortiBleed is included. The FBI and US Secret Service confirmed 86,644 FortiGate devices compromised globally in the FortiBleed campaign, which uses similar targeting and methodology. Together, the two campaigns represent the most significant perimeter appliance credential exposure since the 2024 Ivanti Connect Secure credential dump affecting more than 20,000 organizations.

Geographic targeting in k0t's disclosed campaign prioritizes the United States and Canada, followed by the United Kingdom, Germany, France, Japan, and Australia. Every industry sector is represented in the exposed dataset, but Group-IB reported higher densities in technology, financial services, and manufacturing verticals, consistent with the sectors these devices are most heavily deployed in.

The LDAP dump component elevates severity significantly beyond a typical VPN credential compromise. LDAP dumps include Active Directory user and group structures, organizational unit hierarchies, and in some configurations password hashes for all domain accounts. A ransomware operator purchasing k0t access receives not just a VPN foothold but a pre-mapped domain environment with enough directory intelligence to target domain controllers and backup systems in the first hours of an intrusion.

Victim organization overlap with the peerstitch-fortigate-implant-cl-sta-0954-detection campaign from earlier this month suggests multiple threat actors are actively targeting the same exposed FortiGate population simultaneously. Organizations that patched the PeerStitch campaign's implant vector must separately verify they are not in the k0t credential dataset.

Group-IB documented k0t's post-exploitation toolkit in detail, providing high-confidence detection targets for organizations hunting for prior compromise.

NetExec is the maintained successor to CrackMapExec, used for authenticated network enumeration and lateral movement across SMB, LDAP, and WinRM. k0t's use pattern is consistent with an initial host inventory sweep: enumerate live Windows hosts reachable from the compromised VPN context, test credential validity across the discovered subnet, and identify high-value targets including file servers, backup agents, and domain controllers.

Impacket is a Python library for network protocol interaction used for pass-the-hash attacks, Kerberos ticket manipulation, and command execution without installing agents on target hosts. k0t's Impacket usage is consistent with post-credential-spray lateral movement to domain-joined hosts.

Mimikatz on compromised Windows hosts extracts plaintext credentials from LSASS memory, NTLM hashes, Kerberos tickets, and cached credentials. Credentials harvested here become part of the LDAP and credential package sold to ransomware operators, extending the dataset beyond what is visible in the FortiGate or GlobalProtect device logs.

MeshCentral and Atera are legitimate remote management platforms that k0t installs as persistence mechanisms. Both are signed software trusted by endpoint security tools, communicate over standard HTTPS to cloud-hosted management servers, and blend with legitimate IT operations. Group-IB identified 28 device groups with 84 systems connected to a single k0t-operated MeshCentral server, which represents only the confirmed persistent access that remained active at disclosure time.

The toolset is identical to the pattern observed in the watchguard-firebox-cve-2025-14733-ransomware-exploitation campaign, suggesting k0t or a closely affiliated actor has been using this playbook across multiple edge device campaigns throughout 2026.

The following indicators cover both the perimeter exploitation phase and the post-compromise tooling phase. Network-level IOCs (specific k0t C2 IPs and domains) are included in Group-IB's Threat Intelligence platform; the indicators below are the publicly disclosed behavioral and infrastructure markers available at time of publication.

Verify all hash indicators against your EDR telemetry covering the past 120 days. MeshCentral and Atera agent installs may predate the October 21 disclosure by months.

Two Sigma rules detect k0t post-exploitation activity on Windows hosts accessed from compromised FortiGate or GlobalProtect VPN contexts: unauthorized RMM agent installation and LSASS credential access by lateral movement tooling. Both carry experimental status; validate field names against your endpoint telemetry schema before enabling automatic blocking.

Any organization running internet-facing FortiGate, FortiWeb, or Palo Alto GlobalProtect must act today. The 47-day gap between the start of CVE-2026-0257 exploitation (June 2026) and public attribution means four months of potential unauthorized access may predate this advisory.

The k0t campaign and the broader FortiBleed problem represent the same structural failure: internet-facing network security appliances treated as trusted infrastructure rather than as attack surfaces requiring the same credential hygiene as internal systems. The 86,644 FortiGate devices compromised in FortiBleed were not breached because of zero-day vulnerabilities. Most were compromised through brute-forced default credentials, reused passwords, and unpatched CVEs with public patches available for months.

The downstream consequence of VPN credential exposure is ransomware at scale. Qilin and Inc ransomware operators purchasing k0t access are buying a pre-validated foothold that skips the phishing, initial access, and lateral movement phases entirely. The LDAP dumps included in many k0t packages mean ransomware operators arrive with a complete organizational directory, pre-mapped privilege paths, and administrator accounts they can validate before deploying encryptors. The average ransomware operator using purchased access can move from initial foothold to domain admin escalation in under 4 hours.

Defenders who have not explicitly addressed VPN and network device credential hygiene in the past 6 months have likely had unauthorized access to their perimeter devices for a substantial portion of that window. The action is not to wait for official notification from Group-IB or law enforcement -- it is to treat these devices as compromised now, rotate credentials, and hunt for MeshCentral and Atera persistence artifacts.

Every week of delay in rotating FortiGate and GlobalProtect credentials is another week that k0t's customers have authenticated, active access to affected environments.