The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between February and June 2026, a threat actor tracked as k0t (aliases: CryptoFeel, Member19, QazWsxShop) executed a large-scale credential harvesting campaign against internet-exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices worldwide. Leveraging public scanning tools such as FOFA and ZoomEye, k0t enumerated vulnerable edge appliances and exploited CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS authentication bypass) via bespoke Python scripts. Post-exploitation actions included Active Directory enumeration, persistence via MeshCentral, Atera, and AnyDesk, and data exfiltration through Rclone to Wasabi S3 and MEGA. Over 70,000 credentials were harvested, with victims spanning Asia Pacific, Latin America, Europe, and MENA.

This campaign underscores the accelerating role of initial access brokers (IABs) feeding ransomware groups such as Qilin and The Gentlemen. With edge device exploitation now industrialized through automated scanning and off-the-shelf exploit scripts, organizations relying solely on perimeter firewalls face systemic credential exposure risk—making zero trust segmentation and encrypted east-west traffic controls critically urgent.

Why This Matters Now

Edge device vulnerabilities are being weaponized at industrial scale in 2026: k0t's campaign harvested over 70,000 credentials in months using automated scanning and public CVE exploits, and directly fed ransomware affiliate chains. Regulatory frameworks including PCI DSS 4.0 and NIST CSF now require demonstrable network segmentation and encrypted data-in-transit controls—gaps this attack exploited directly. Organizations without cloud-native zero trust enforcement remain exposed to the same IAB playbook today.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

k0t used public scanning tools like FOFA and ZoomEye to enumerate internet-exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices, then exploited CVE-2025-64446 and CVE-2026-0257 via custom Python scripts or brute-force attacks to obtain initial access.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because k0t's success depended on unrestricted lateral movement, unchecked egress paths, and broad network reachability following initial VPN compromise. Distributed policy enforcement, workload-level segmentation, and controlled egress controls would likely have reduced the attacker's operational reach and constrained the volume of credentials accessible for exfiltration.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Distributed CNSF policy enforcement at the network edge could likely have reduced the reachable attack surface by flagging anomalous authentication patterns and limiting inbound access to only explicitly authorized endpoints, making opportunistic exploitation of exposed appliances harder to operationalize at scale.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware segmentation policies would likely have constrained the actor's ability to reach Active Directory-critical paths and high-value credential stores from a freshly compromised session, reducing the scope of privilege escalation achievable without explicit authorization for each access path.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west enforcement policies could likely have detected and blocked unauthorized inter-segment traversal attempts, meaningfully reducing the actor's ability to reach credential stores and additional endpoints beyond the initially compromised host.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized traffic observability across cloud environments would likely have surfaced unexpected outbound sessions to remote access platforms, giving defenders a meaningful opportunity to identify anomalous C2 patterns that would otherwise blend into legitimate traffic, reducing the attacker's ability to maintain undetected persistent access.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: FQDN-based egress filtering would likely have blocked or alerted on Rclone transfers directed toward unauthorized cloud storage destinations like Wasabi and MEGA, significantly reducing the volume of credentials successfully exfiltrated even if earlier stages were not fully constrained.

Impact (Mitigations)

Had earlier segmentation and egress controls reduced the scope of accessible credentials and reachable segments, the access package sold to ransomware affiliates would likely have had materially lower value — translating to fewer systems reachable for encryption and a smaller pool of exfiltrated data available for double-extortion leverage.

Impact at a Glance

Affected Business Functions

  • Network Perimeter Security and VPN Remote Access Services
  • Active Directory and Identity and Access Management (IAM)
  • Corporate Data and Intellectual Property Confidentiality
  • IT Security Operations and Incident Response
Operational Disruption

Estimated downtime: 21 days

Financial Impact

Estimated loss: N/A

Data Exposure

Over 70,000 enterprise credentials associated with network edge devices and LDAP/Active Directory dumps were confirmed harvested across victim organizations globally. Exposed data categories include VPN and firewall administrator credentials, Active Directory user and service account credentials, LDAP directory contents, and internal network enumeration data. Post-exploitation activity included SMB enumeration, antivirus solution fingerprinting, and data exfiltration via Rclone to Wasabi S3 and MEGA cloud storage. Victim organizations span Asia Pacific (38%), Latin America (31.9%), Europe (15.8%), and MENA (12.7%) across multiple industry sectors. Secondary ransomware deployment by Qilin and The Gentlemen affiliate groups indicates downstream risk of full data encryption and extortion demands, with average enterprise ransomware financial impact estimated between $1.85M and $4.5M per incident per industry benchmarks, though confirmed aggregate financial loss figures for this campaign are not publicly disclosed.

Recommended Actions

  • • Deploy Cloud Firewall (ACF) and Inline IPS (Suricata) at all internet-facing edge ingress points to block exploit attempts targeting known CVEs (CVE-2025-64446, CVE-2026-0257) and to restrict inbound attack surface against VPN and firewall appliances enumerated via FOFA or ZoomEye.
  • • Enforce Zero Trust Segmentation with microsegmentation and identity-based policy (SmartGroups, namespace enforcement) across all internal segments to prevent post-compromise lateral movement via SMB, AD abuse tools (PetitPotam, noPac, Mimikatz), and inter-host pivoting.
  • • Activate Egress Security & Policy Enforcement with FQDN filtering and data loss prevention to block unauthorized outbound connections to Rclone, Wasabi S3, MEGA, and unapproved remote access platforms (AnyDesk, Atera, Teramind, MeshCentral), cutting off both C2 and exfiltration channels.
  • • Enable Multicloud Visibility & Control with centralized traffic observability and behavioral baselining to detect anomalous patterns such as bulk LDAP enumeration, mass credential staging, and unexpected remote access tool installations that characterize k0t-style IAB operations.
  • • Apply Encrypted Traffic (HPE) controls using MACsec or IPsec for all data-in-transit across hybrid and cloud paths to ensure that even if network edges are compromised, intercepted credential and LDAP data in transit cannot be read or exfiltrated in cleartext by adversaries performing passive collection.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image