Security researchers at Group-IB and NyxLab have uncovered more than 70,000 network credentials tied to a campaign by the cyber threat group k0t. According to Group-IB, the operation went beyond credential theft: the attackers also created backdoors into corporate networks, opening a possible access pipeline that ransomware groups could exploit to infiltrate company systems.

Credentials Were Only the Entry Point

The researchers documented several intrusion techniques used by the attackers, including the abuse of passwords on Fortinet's FortiGate devices, exploitation of CVE-2025-64446, a vulnerability affecting the company's FortiWeb, and use of CVE-2026-0257 against vulnerable Palo Alto GlobalProtect gateways. Because these appliances act as shields for corporate networks and grant remote access to them, they rank among the most desirable targets for anyone seeking to break into company systems.

The stolen data included LDAP (Lightweight Directory Access Protocol) directory dumps, which catalog the user accounts, groups, and resources inside a corporate network. After gaining a foothold, the attackers maintained access through OpenConnect VPN connections, remote management applications, and the AdaptixC2 command-and-control framework. Some victims were subjected to data theft as well. Many of the FortiGate compromises occurred between February and June 2026.

Afterward, a number of victims appeared on the leak pages of the ransomware groups Qilin and The Gentlemen. The pattern suggests k0t may be profiting from access to compromised networks, though researchers have yet to verify that connection. Selling network footholds to ransomware crews is an established criminal business model known as initial access brokering.

The campaign also showed considerable reach in Asia-Pacific, the source of 37.6% of all unique domains observed. The researchers stressed that this may simply reflect the number of devices active in the region, rather than a deliberate focus on Asian targets.

FortiBleed Remains a Separate, Active Threat

An advisory issued on October 6, 2026 by the FBI and the U.S. Secret Service cautioned that FortiBleed still poses a threat to FortiGate firewalls and SSL VPN gateways. In that campaign, attackers reused credentials secured earlier, deployed GPU-based systems to decode password hashes, and created new administrator accounts — at times managing to lock victims out of their own devices.

FortiBleed has spread worldwide: SOCRadar verified more than 86,644 compromised devices across 194 countries. Fortinet said the attackers reused stolen login credentials and attempted to guess passwords, and that the campaign did not involve a newly disclosed Fortinet vulnerability.

Group-IB found little overlap between FortiBleed and k0t's stolen data but has not ruled out a connection between the two operations. So far, no evidence indicates that the same attackers were behind both incidents. The figures also measure different things — k0t's 70,000 credentials versus FortiBleed's 86,644 devices — and combining them would distort the full scale of the events.

From Initial Access to Ransomware in 22 Seconds

Verizon's 2026 Data Breach Investigations Report found that vulnerability exploitation accounted for 31% of breaches, overtaking stolen credentials as the leading entry method. Yet only 26% of critical, known-exploited vulnerabilities were fully remediated, with the median time to fix them reaching 43 days.

That delay is particularly concerning because attackers can exploit vulnerabilities before patches become available. Mandiant's M-Trends 2026 estimated a minus-seven-day mean time to exploit, indicating that attacks often begin before fixes are released. VPN gateways and routers are especially difficult to monitor because they often lack standard endpoint security tools.

Once attackers gain access, the threat can escalate quickly. Mandiant found that the median time between an initial breach and the hand-off to another criminal group fell from more than eight hours in 2022 to just 22 seconds in 2025.

The danger is already visible. In an October 19 update, Unit 42 reported attempted exploitation of CVE-2026-0257 — the same Palo Alto flaw exploited in the k0t campaign — by Qilin and Inc ransomware operators It also noted separate reports involving Settra. However, its earlier investigation found no evidence that attackers had moved deeper into affected networks.

What It Means for Finance and Crypto Infrastructure

IBM found that 62% of reported AI-driven attacks targeted critical infrastructure, while financial-services breaches averaged $6.3 million. The IMF also warned in October that cyber threats could become systemic as financial networks grow more interconnected.

Crypto firms face similar risks from compromised access. Cryptopolitan reported roughly $2 million in losses involving Fetch.ai and NuNet in September 2026. Those incidents involved compromised signing credentials rather than VPN access, and no established connection to k0t exists. Across both sectors, the reported incidents share a common element: access — whether through a VPN gateway or a signing credential — is what turns a technical intrusion into financial loss.