A large-scale cyberattack campaign attributed to the threat actor k0t has exposed more than 70,000 credentials, intensifying concerns over corporate network security and the potential for follow-on ransomware attacks. The operation targeted vulnerable firewalls and remote-access systems used by businesses worldwide.

Cybersecurity researchers from Group-IB and NyxLab disclosed the findings on October 21, 2026. Their investigation indicates that the attackers established persistent access to compromised networks, potentially creating opportunities for ransomware operators.

How Attackers Breached Corporate Networks

The k0t campaign focused on internet-facing security products, including Fortinet FortiGate firewalls, FortiWeb systems, and Palo Alto Networks GlobalProtect gateways. The operators combined password attacks with the exploitation of known security flaws, among them CVE-2025-64446, which affects FortiWeb, and CVE-2026-0257, which affects certain GlobalProtect configurations.

Perimeter devices of this kind are attractive targets because they face the public internet, and a single compromise can expose stored authentication data and directory records across an organization.

Once inside, the operators extracted stored credentials and directory information. To maintain their foothold, they relied on OpenConnect VPN connections, remote-management software, and the AdaptixC2 tool. Researchers identified more than 70,000 exposed credentials and related records, though they cautioned that this figure does not confirm that every credential remained valid or that each one led to a successful intrusion.

Possible Links to Ransomware Operations

Investigators found that some affected organizations later appeared on ransomware leak sites associated with the groups Qilin and The Gentlemen. The pattern suggests that k0t may operate as an initial access broker, obtaining unauthorized network access on behalf of other criminal groups. However, researchers have not confirmed any direct relationship between the campaign and those ransomware operators. That distinction matters because access brokers and the crews that carry out encryption and extortion are typically separate operations, which is why researchers treat the leak-site appearances as a pattern to be verified rather than a confirmed link.

The investigation also identified similarities to FortiBleed, an earlier campaign involving compromised Fortinet credentials. Despite these parallels, researchers found minimal overlap between the two credential datasets and could not establish whether the same operators were behind both campaigns. The comparison nonetheless reflects a recurring concern for defenders: repeated waves of attacks against widely deployed perimeter appliances.

Financial and Crypto Businesses Face Elevated Risk

The exposed dataset showed that Asia-Pacific accounted for 37.6% of unique domains, though researchers cautioned that this distribution does not necessarily indicate deliberate regional targeting.

For financial institutions and cryptocurrency businesses, compromised network access carries significant operational risk. Attackers holding privileged credentials could potentially reach sensitive systems, disrupt services, or steal confidential information. Investigators have not, however, established a direct connection between k0t and any cryptocurrency theft.

Security specialists recommend patching exposed devices, restricting administrative access, rotating compromised credentials, and reviewing suspicious VPN activity. The disclosure of specific CVE identifiers gives network teams a concrete starting point for remediation. The findings underscore how weaknesses in widely deployed network infrastructure can open the door to broader cybercrime. As investigations continue, the suspected link between credential theft and ransomware operations remains an important unresolved concern, and the details to watch are whether more affected organizations surface on leak sites and whether researchers can directly tie k0t to specific ransomware operators.