Exposed Firewalls and VPNs Targeted in Global Campaign Linked to Ransomware Groups

Researchers from Group-IB and NyxLab have disclosed a large-scale campaign aimed at internet-exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The activity is attributed to a threat actor called k0t, who also uses the names CryptoFeel, Member19 and QazWsxShop, and was first seen on October 22, 2025. The researchers say the operators gained access to numerous organisations worldwide and tried to go further against some victims, resulting in persistent remote access and data theft.

The actor is assessed to be connected to ransomware groups such as Qilin and The Gentlemen, likely working as an initial access broker or affiliate. Targets appear to be chosen by scanning for exposed devices at scale, not by researching individual organisations. In the researchers' words, the product and location of a device matter more than the industry of its owner. A significant share of compromises took place between February and June 2026, overlapping with another credential harvesting campaign codenamed FortiBleed. Nearly 38% of victims are in the Asia Pacific region.

Once inside, the attackers used legitimate administrator and penetration testing tools, including NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz, to move deeper into corporate networks. The source article is only partly reproduced here, so further technical details are not covered.