Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

What happened

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls (a barrier that decides which network traffic may pass). Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials  Ravie Lakshmanan  Oct 23, 2026 Vulnerability / Cyber Attack Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.

"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration," according to a joint investigation published by Group-IB and NyxLab. Analysis of the threat actor's dark web activity reveals a keen interest in purchasing vulnerability exploit code and tools or premium accounts for metadata search engines like FOFA and ZoomEye .

Attempt to exploit these devices via known vulnerabilities like CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access. The widespread exploitation activity has been attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop.

The cybercriminal actor was first seen in the wild on October 22, 2025. The threat actor is assessed to share connections with ransomware (software that locks up files and demands payment) groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate.