Summary Points
- Threat actor k0t is targeting internet-exposed Fortinet and Palo Alto firewalls, apparently scanning broadly rather than selecting specific industries.
- The campaign exploits known flaws—including CVE-2025-64446 and CVE-2026-0257—or uses brute force to gain initial access.
- Attackers steal credentials, establish persistent remote access, move through networks, and exfiltrate data; more than 70,000 exposed credentials have been linked to the activity.
- Victims span multiple regions, especially Asia-Pacific and Latin America. Patch affected devices and secure exposed edge systems; links to ransomware groups Qilin and The Gentlemen remain unclear.
Exposed Firewalls Put Company Accounts at Risk
A global hacking campaign has targeted internet-connected firewalls and virtual private networks (VPNs), exposing more than 70,000 credentials, investigators report. The affected devices include products from Fortinet and Palo Alto Networks.
The campaign focused on devices that companies had left reachable from the internet. Attackers scanned for vulnerable equipment, then tried known software flaws or common passwords to get inside. Most reported breaches occurred between February and June 2026.
The stolen information included credentials from network devices and company account directories. With those details, attackers can try to enter other systems, much as a copied office key can open more than one door.
How Companies Can Reduce the Risk
After gaining access, attackers searched company networks for accounts and other useful information. They also installed remote-access tools to keep a foothold and moved stolen data to online storage. Investigators found links between some victims and ransomware groups, but they say the exact relationship remains unclear.
The campaign hit organizations across many industries and regions. Nearly 38% of victims were in Asia Pacific, while about 32% were in Latin America. This broad reach suggests attackers often chose exposed devices rather than specific companies.
Companies should install security updates, replace weak or reused passwords, and limit internet access to firewall and VPN management tools. They should also review remote-access activity and reset credentials that attackers may have stolen. These steps cannot remove every risk, but they can make a successful breach harder to extend.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
