k0t: Group-IB and NyxLab describe a probable access broker that mass-exploits FortiWeb and PAN-OS GlobalProtect, brute-forces FortiGate and decrypts stolen FortiGate configurations offline with the default key, with victims later listed by Qilin and The Gentlemen
Group-IB: k0t takes edge devices in bulk and decrypts FortiGate configurations offline; enable private-data-encryption
Defender actions
- On every FortiGate (FortiOS 5.6.11, 6.0.7, 6.2.1 or later; check the FortiManager and HA note in Fortinet's FG-IR-19-007 first where it applies), enable private-data-encryption with an operator-defined key, and for any device that was internet-reachable with a brute-forceable administrator login or an unpatched exposed service, treat the LDAP and Active Directory bind and administrator credentials stored in its configuration as known to the attacker and rotate them, bind accounts first.
Analysis
Group-IB and NyxLab describe a campaign by an operator they track as k0t (Group-IB lists CryptoFeel as a potential alias, and Scrooge as a likely collaborator and possible alias) that enumerates internet-facing VPN and firewall appliances in bulk and attacks the product directly, chiefly Fortinet firewalls and Palo Alto GlobalProtect portals (Group-IB, 2026-10-21). A custom script exploits CVE-2025-64446 against FortiWeb, a relative path traversal that lets an unauthenticated attacker run administrative commands, or brute-forces exposed Fortinet devices as a fallback (Group-IB, 2026-10-21; CISA KEV, 2026-10-21). Against PAN-OS it exploits CVE-2026-0257, the GlobalProtect authentication bypass, with a forged authentication-override cookie (Group-IB, 2026-10-21). On a compromised FortiGate the tool downloads the configuration and decrypts its secrets locally with the default FortiOS key, the weakness tracked as CVE-2019-6693, recovering LDAP and Active Directory bind and, Group-IB says, administrator credentials, although Fortinet's advisory excludes the administrator's password and says FIPS-CC devices are not impacted; unless private-data-encryption is set, the device falls back to that known key (Group-IB, 2026-10-21; Fortinet, 2019-11-19).
After access the operators work by hand with NetExec, Impacket, Kerbrute, relayed PetitPotam and Mimikatz, keep access through OpenConnect, MeshCentral agents, AdaptixC2, Atera and AnyDesk, and exfiltrate with Rclone to Wasabi and MEGA (Group-IB, 2026-10-21). Group-IB sees victim overlap with the Qilin and The Gentlemen leak sites and assesses the operators are probably initial-access brokers, but says no relationship is confirmed, and it found indications of a possible connection with the FortiBleed cluster alongside negligible overlap in the compromised credentials (Group-IB, 2026-10-21). CISA lists all three CVEs in KEV, with ransomware use marked known for CVE-2026-0257 and CVE-2019-6693 (CISA KEV, 2026-10-21).
Triage: OpenConnect, MeshCentral, Atera, AnyDesk and Rclone are legitimate tools, so Group-IB advises judging execution context, installation source, operator account, destination and timing rather than tool names (Group-IB, 2026-10-21).
Cited evidence
Large-scale campaign involving vulnerability exploitation and brute-forcing of exposed network devices
Many victims seen in this campaign have also been observed to be later listed by ransomware groups, Qilin and the Gentlemen, on their Data Leak Sites (DLS).
Because this decryption is performed against a copy of the configuration held by the operator, it is not detectable on the appliance itself and cannot be prevented by access control alone
Enable the ‘private-data-encryption’ setting on FortiGate appliances and supply an operator-defined key.
Sources5
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.