Log in Request a demo

Threat group profile

k0t Threat Actor: Edge Device Campaign Against FortiGate and GlobalProtect

Also known as k0t, CryptoFeel, Member19

k0t is a threat actor that Group-IB and NyxLab, in a joint report of 21 October 2026, describe as likely one of the main operators of a large campaign.

In short

k0t is a threat actor that Group-IB and NyxLab, in a joint report of 21 October 2026, describe as likely one of the main operators of a large campaign. The campaign targets exposed FortiGate, FortiWeb and Palo Alto GlobalProtect devices. They say current evidence suggests the operators are likely acting as initial access brokers, a role they have not confirmed.

Last updated 23 October 2026

Profile MapThreat Group
  1. Names3names in public reportsk0t · CryptoFeel · Member19
  2. Sectors6named as targetsWide range of industries · Stated priority · 37.6 percent of unique domains
  3. Techniques14in the attack chainReconnaissance · Initial Access · Credential Access
  4. Tools12tools and malware listedFortiGate Security Scanner · OpenConnect · MeshCentral and MeshAgent

In one minute

Who they are
Group-IB and NyxLab (21 October 2026) describe k0t as likely to be one of the main operators of an edge device campaign. The report says the campaign likely involved several operators. The report names no country and no sponsor.
Who they target
Victims are global and come from many industries. The two firms say the product and location of an exposed device appear to matter more than the victim's industry. Asia Pacific has the largest share of the unique domains found, 37.6 percent, which they say is not proof of regional targeting.
How they usually get in
Bulk scanning with search engines such as FOFA and ZoomEye. Then CVE-2025-64446 against FortiWeb, brute force against FortiGate and CVE-2026-0257 against GlobalProtect. The operators then connect through OpenConnect VPN.
What stands out
Group-IB and NyxLab report more than 70,000 exposed credentials associated with network devices, LDAP dumps and similar data. They say these were not linked to any other threat actors, including the previously reported FortiBleed cluster. They assess with moderate confidence that the cluster is associated with broader FortiBleed related activity. They found negligible overlap in compromised credentials, and say this does not establish that the same operators controlled both datasets. Many victims were later listed by Qilin and The Gentlemen, a link the report calls unconfirmed.
What to do first
Take FortiGate, FortiWeb and GlobalProtect management pages off the internet, patch them, and rotate every credential stored on these devices, including LDAP and Active Directory bind accounts. On FortiGate, turn on the private-data-encryption setting.

Overview

Group-IB and NyxLab published a joint report on k0t on 21 October 2026. They say current evidence suggests the operators are likely acting as an initial access broker: scan for exposed devices, get in, and pass the access on. They call this an assessment, and they have not confirmed it.

Many victims of the campaign were later listed on the leak sites of Qilin ransomware and The Gentlemen. The report treats this as an overlap of victims, not as proof of a relationship.

One way in was CVE-2026-0257 in PAN-OS GlobalProtect. The report also compares the cluster with the FortiBleed credential exposure. It assesses with moderate confidence that the cluster is associated with broader FortiBleed related activity. It finds negligible overlap in credentials, and says the evidence does not establish that the same operators controlled both datasets. After entry, the operators used tools such as Mimikatz and Impacket. A further technical report is promised.

Names

Public reports use several names for this activity.

Names used for k0t Threat Actor: Edge Device Campaign Against FortiGate and GlobalProtect
NameWhere it appears
k0t Group-IB and NyxLab name for the actor; the report calls it likely to be one of the main operators of the campaign[1]
CryptoFeel Group-IB and NyxLab: potentially an alias of k0t[1]
Member19 Group-IB and NyxLab: alias under which the intruder left reviews of a service that provides IP lists of network devices (Figure 3 of the report)[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • Group-IB and NyxLab 21 October 2026

    Said k0t is likely to be one of the main operators of the campaign and that available evidence points to several operators working together.[1]

  • Group-IB and NyxLab 21 October 2026

    Said CryptoFeel is potentially an alias of k0t, and that the intruder left reviews of an IP list service under the aliases Member19 and CryptoFeel.[1]

  • Group-IB and NyxLab 21 October 2026

    Said a figure the report calls Scrooge or ScroogeMcDuck is likely a collaborator and that several tools seen were likely acquired by that figure.[1]

  • Group-IB and NyxLab 21 October 2026

    Said current evidence suggests the operators are likely acting as initial access brokers. They also said artifacts suggest parts of the access obtained were consolidated for other operators and potentially to be sold to ransomware groups.[1]

  • Group-IB and NyxLab 21 October 2026

    Said many victims were later listed by Qilin and The Gentlemen on their leak sites. They said the relationship between k0t and these groups is still unconfirmed.[1]

  • Group-IB and NyxLab 21 October 2026

    Assessed with moderate confidence that the cluster is associated with broader FortiBleed related activity. They said this does not establish that the same operators controlled both credential datasets.[1]

  • Group-IB and NyxLab 21 October 2026

    Said the credentials from this activity show a negligible overlap with the credential data of the FortiBleed cluster.[1]

  • Group-IB and NyxLab 21 October 2026

    Said the developers named in the tools, BH and BeiDou, are not linked directly to the campaign and may be freelance developers used by several actors.[1]

  • Group-IB and NyxLab 21 October 2026

    Said an Asia Pacific share of 37.6 percent of unique domains should not be read as proof of deliberate regional targeting.[1]

Where sources differ

Only one primary source, the joint report of Group-IB and NyxLab, describes this cluster so far, so there is nothing to compare yet. The report says public descriptions of FortiBleed differ in scope, and its comparison uses Fortinet's June 2026 assessment of that activity. The two firms say a longer technical report will follow.

Who they target

Sectors

  • Wide range of industriesGroup-IB and NyxLab say victims are global and from many industries. They say device product and location seem to matter more than the victim's industry.[1]
  • FortiGate, FortiWeb and Palo Alto GlobalProtectThe majority of devices seen targeted are Fortinet firewalls and GlobalProtect devices or portals. GlobalProtect portals were the most prominent target in the observed searches.[1]
  • SonicWall SMA1000, OPNsense, Cisco ISESearches for SMA1000 consoles suggest interest, OPNsense was among products checked, and vulnerability monitoring extended to Cisco ISE. The report says current evidence does not show a successful SMA1000 compromise.[1]
  • Stated priorityThe report says k0t's stated geographic priorities begin with the United States and Canada, then European countries and selected APAC markets.[1]
  • 37.6 percent of unique domainsLargest regional share of the unique domains in the dataset, a figure the report says may reflect where exposed devices are, not targeting.[1]
  • Large share of unique domainsThe report says Asia Pacific and Latin America account for the largest share of unique domains in the dataset.[1]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 8 Dec 2025

    Date in the FortiGate scanner script

    The script that exploits CVE-2025-64446 and brute forces Fortinet devices carries the version string 2025-12-08.[1]

  2. Feb to Jun 2026

    Many FortiGate compromises dated

    Group-IB and NyxLab say many FortiGate compromises in the data date from February to June 2026. They call this a stark overlap with the FortiBleed campaign.[1]

  3. Jun 2026

    FortiBleed cluster reported

    The report refers to the FortiBleed cluster seen earlier in 2026, in June, and finds possible links to it.[1]

  4. 21 Oct 2026

    Joint report published

    Group-IB and NyxLab publish their findings and promise a further technical report.[1]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Reconnaissance

  • Search Open Technical Databases: Scan Databases T1596.005

    Group-IB and NyxLab say k0t used scanning services such as FOFA and ZoomEye to find exposed devices.[1, 3]

Initial Access

  • Exploit Public-Facing Application T1190

    The report says operators exploited public-facing FortiWeb and GlobalProtect services.[1, 4]

  • External Remote Services T1133

    After access to FortiGate, FortiWeb and GlobalProtect devices, operators connected through OpenConnect.[1, 6]

Execution

  • Command and Scripting Interpreter: PowerShell T1059.001

    PowerShell scripts were used widely to install AdaptixC2 agents.[1, 11]

Persistence

  • Create Account: Local Account T1136.001

    After access to FortiGate and FortiWeb devices, operators created new local administrator accounts.[1, 8]

Privilege Escalation

  • Exploitation for Privilege Escalation T1068

    The noPac tool chained CVE-2021-42278 and CVE-2021-42287 to reach Domain Admin.[1, 15]

Credential Access

  • Brute Force: Password Spraying T1110.003

    The report says operators sprayed lists of common Fortinet passwords across many devices.[1, 5]

  • OS Credential Dumping: LSASS Memory T1003.001

    Operators dumped credentials from the memory of the Windows login process with NetExec.[1, 12]

  • Steal or Forge Kerberos Tickets: Kerberoasting T1558.003

    Operators used the Impacket script GetUserSPNs to extract service-account Kerberos hashes.[1, 13]

  • Forced Authentication T1187

    Operators coerced domain controllers to authenticate to a machine they controlled, so the authentication could be relayed.[1, 14]

Lateral Movement

  • Use Alternate Authentication Material: Web Session Cookie T1550.004

    The report lists forged cookies used against GlobalProtect with CVE-2026-0257 under this technique.[1, 7]

Collection

  • Data from Configuration Repository: Network Device Configuration Dump T1602.002

    Operators dumped device configuration data and decrypted the stored secrets offline.[1, 9]

Command and Control

  • Remote Access Tools T1219

    The report lists Atera, Teramind, AnyDesk, ngrok, MeshCentral with MeshAgent, and AdaptixC2.[1, 10]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002

    Rclone was used to send data to Wasabi S3 buckets and MEGA cloud drives.[1, 16]

Tools and malware

  • FortiGate Security Scanner Custom attack script

    The operators' own script, named fort.py and fortnew.py. It exploits CVE-2025-64446 on FortiWeb, brute forces FortiGate devices and can download and decrypt device configurations.[1]

  • CVE-2026-0257 PAN-OS GlobalProtect Scanner + VPN Connect Custom exploit tool

    Scans for vulnerable GlobalProtect portals, forges an authentication override cookie and connects through OpenConnect.[1]

  • OpenConnect VPN client

    Used to connect to victim networks through compromised Fortinet and GlobalProtect devices.[1]

  • MeshCentral and MeshAgent Remote management platform

    Legitimate open source software abused for persistent remote control. The report counts 84 devices in 28 active device groups.[1]

  • AdaptixC2 Open source C2 framework

    Used as a second command channel alongside MeshCentral. Agents were delivered as a fake software installer.[1]

  • Atera, Teramind, AnyDesk and ngrok Remote access and tunneling tools

    Common remote management tools the report says the operators abused for persistence.[1]

  • NetExec Post-exploitation tool

    Used for SMB and LDAP enumeration, dumping SAM, LSA, LSASS and DPAPI secrets, and remote execution.[1]

  • Impacket Python toolkit

    Used for the GetUserSPNs and secretsdump scripts.[1]

  • Mimikatz Credential dumping tool

    Seen used to dump cleartext passwords and NTLM hashes from LSASS.[1]

  • noPac, Kerbrute and PetitPotam Active Directory attack tools

    noPac for escalation to Domain Admin, Kerbrute for password spraying and PetitPotam to coerce domain controllers.[1]

  • SoftPerfect Network scanner

    Used for discovery of shares, hosts and services.[1]

  • Rclone Cloud storage utility

    Used to move data to Wasabi S3 buckets and MEGA cloud drives.[1]

Detection and defense

  1. Take management pages off the internet

    Put network management consoles inside an internal network and allow access only from trusted admin networks or VPN. The operators found devices through public scanning first.

    Counters T1596.005 T1190

  2. Patch edge devices first

    Patch internet-facing network devices before anything else. The report names CVE-2025-64446 for FortiWeb and CVE-2026-0257 for vulnerable GlobalProtect setups.

    Counters T1190 T1550.004

  3. Stop easy guessing

    Change default passwords, avoid common ones, raise the login lockout time and investigate repeated lockouts. Apply MFA to all accounts where possible.

    Counters T1110.003

  4. Protect stored appliance secrets

    Turn on the private-data-encryption setting on FortiGate with a key you define. Without it the device uses a default AES key, a weakness tracked as CVE-2019-6693, and a copied configuration can be decrypted by anyone.

    Counters T1602.002

  5. Rotate what the device knows

    Treat an exposed FortiGate configuration as a credential disclosure. Rotate every credential in it, including LDAP, Active Directory bind and service accounts, and use a low-privilege bind account.

    Counters T1602.002 T1003.001

  6. Review administrator accounts

    Check for local administrators you did not create and for trusted-host settings that no change request explains.

    Counters T1136.001 T1133

  7. Hunt for unapproved remote tools

    Look for MeshAgent, MeshCentral, AdaptixC2, Atera, Teramind, AnyDesk and ngrok, and confirm each has an approved owner and purpose.

    Counters T1219

  8. Watch for data leaving through Rclone

    Investigate unexpected Rclone runs and transfers to Wasabi S3 and MEGA, especially after credential access or broad file listing.

    Counters T1567.002

What Brandefense can do

Questions

Who is k0t?

Group-IB and NyxLab describe k0t as likely to be one of the main operators of a campaign against exposed FortiGate, FortiWeb and GlobalProtect devices. Their report of 21 October 2026 names no country and no sponsor.

Is k0t a ransomware group?

No source says so. Group-IB and NyxLab say current evidence suggests the operators are likely initial access brokers. They saw victims later listed by Qilin and The Gentlemen, but say the relationship is unconfirmed.

Which flaws and devices does the campaign use?

The report names CVE-2025-64446 for FortiWeb and CVE-2026-0257 for vulnerable GlobalProtect setups. FortiGate devices are not vulnerable to the FortiWeb exploit and were attacked by brute force. A default AES key weakness, CVE-2019-6693, was used to decrypt downloaded FortiGate configurations.

Is k0t the same as FortiBleed?

Not shown. Group-IB and NyxLab assess with moderate confidence that the cluster is associated with broader FortiBleed related activity. They found negligible overlap in the credential data and say the evidence does not show the same operators controlled both.

Does the Asia Pacific share show that k0t targets Asia Pacific?

No. The report says 37.6 percent of unique domains are from Asia Pacific but warns this may only reflect where exposed devices are found by public scanning.

What should an organization do first?

Remove management interfaces from direct internet access, patch FortiGate, FortiWeb and GlobalProtect systems, and rotate credentials stored on or reachable through these devices. Group-IB and NyxLab also advise turning on private-data-encryption on FortiGate.

Sources

  1. Stray Cat, Open Doors: How k0t Wanders Through the Network Edge Group-IB with NyxLab Supports: The campaign, aliases, victimology, attack chain, tools, FortiBleed comparison, defensive advice and ATT&CK table.
  2. Groups MITRE ATT&CK Supports: No group entry or alias named k0t, CryptoFeel or Member19 on 23 October 2026.
  3. Search Open Technical Databases: Scan Databases, T1596.005 MITRE ATT&CK Supports: Technique id and name.
  4. Exploit Public-Facing Application, T1190 MITRE ATT&CK Supports: Technique id and name.
  5. Brute Force: Password Spraying, T1110.003 MITRE ATT&CK Supports: Technique id and name.
  6. External Remote Services, T1133 MITRE ATT&CK Supports: Technique id and name.
  7. Use Alternate Authentication Material: Web Session Cookie, T1550.004 MITRE ATT&CK Supports: Technique id and name.
  8. Create Account: Local Account, T1136.001 MITRE ATT&CK Supports: Technique id and name.
  9. Data from Configuration Repository: Network Device Configuration Dump, T1602.002 MITRE ATT&CK Supports: Technique id and name.
  10. Remote Access Tools, T1219 MITRE ATT&CK Supports: Technique id and name.
  11. Command and Scripting Interpreter: PowerShell, T1059.001 MITRE ATT&CK Supports: Technique id and name.
  12. OS Credential Dumping: LSASS Memory, T1003.001 MITRE ATT&CK Supports: Technique id and name.
  13. Steal or Forge Kerberos Tickets: Kerberoasting, T1558.003 MITRE ATT&CK Supports: Technique id and name.
  14. Forced Authentication, T1187 MITRE ATT&CK Supports: Technique id and name.
  15. Exploitation for Privilege Escalation, T1068 MITRE ATT&CK Supports: Technique id and name.
  16. Exfiltration Over Web Service: Exfiltration to Cloud Storage, T1567.002 MITRE ATT&CK Supports: Technique id and name.

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more

Glossary term

Initial access broker

An initial access broker is a criminal who gains access to a company network and passes or sells that access to someone else.

Read more

Incident

Fortinet device credential exposure

In mid-June 2026, government agencies warned that leaked credentials for about 74,000 Fortinet firewalls and VPN gateways were being used against internet-facing devices.

Read more