k0t VPN Credentials Leak: 70,000+ Firewall Logins Exposed

Last updated: 26 October 2026. Sources are listed at the end.

A VPN credentials leak tied to an operator called “k0t” has put more than 70,000 network-device credentials and LDAP dumps in criminal hands. Group-IB and NyxLab published the joint research on 21 October 2026. The Hacker News covered it on 23 October. The targets were internet-facing Fortinet FortiGate firewalls, FortiWeb appliances and Palo Alto Networks GlobalProtect VPN gateways.

This VPN credentials leak did not need a new zero-day. Instead, the operators combined old weaknesses, two known CVEs and plain password guessing. Many victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups. So if your office VPN runs on one of these boxes, treat this as a prompt to check it this week.

The short answer

• Patch FortiWeb against CVE-2025-64446 and PAN-OS against CVE-2026-0257. Both fixes have been out for months.
• On FortiGate, look for admin accounts you did not create, especially ones with the prof_admin profile and no trusted-host limit.
• Rotate every password stored on the firewall: local admins, VPN users and, above all, the LDAP/AD bind account.
• Take the admin login page off the internet, increase the lockout time and enforce MFA on VPN logins.
• Search your firewall and DNS logs for the published IOCs, then preserve the logs before they roll over.

What k0t did, step by step

Group-IB’s report is titled “Stray Cat, Open Doors: How k0t Wanders Through the Network Edge”. It describes an opportunistic operation. The operators did not research particular companies. Instead, they scanned for exposed appliances in bulk and attacked whatever answered.

1. Reconnaissance. First, they pulled lists of VPN and firewall hosts from FOFA, ZoomEye and Censys. They also bought IP lists from underground services.
2. Initial access on FortiWeb. They used CVE-2025-64446, a path traversal flaw, to run admin commands without logging in.
3. Initial access on FortiGate. FortiGate is not affected by that FortiWeb bug. So the script brute-forced the FortiGate REST API with common passwords instead. When a device locked it out, the script simply waited 60 seconds and tried again.
4. Initial access on GlobalProtect. They forged authentication-override cookies (CVE-2026-0257) and then connected with the OpenConnect VPN client.
5. Credential harvesting. After logging in to a FortiGate, the tool could download the configuration. It then decrypted the stored secrets offline with FortiOS’s well-known default key (CVE-2019-6693).
6. Hands-on intrusion. Next, they used NetExec, Impacket, Kerbrute, Mimikatz, PetitPotam and noPac to move from the firewall towards domain admin.
7. Persistence and theft. Finally, they installed MeshCentral agents, AdaptixC2, AnyDesk, Atera, Teramind and ngrok. Then they copied data out with Rclone to Wasabi S3 and MEGA.

On FortiGate, the scanner also created a backdoor admin. According to Group-IB, the account had a random eight-character username, the prof_admin profile and a trusted-host range of 0.0.0.0/0. In other words, it could log in from anywhere.

What was exposed, and where

The researchers counted more than 70,000 exposed credentials and related data. That includes network-device logins and LDAP dumps. Group-IB says Asia-Pacific accounts make up 37.6% of the data. The Hacker News adds figures of 31.9% for Latin America, 15.8% for Europe and 12.7% for the Middle East and North Africa. However, we could only find the APAC figure in the Group-IB page itself.

India is not named in the Group-IB report or in The Hacker News article. Still, APAC is the largest region in the data. So Indian organisations running these devices should not assume this VPN credentials leak skipped them. Meanwhile, the FortiGate script carries a hard-coded exclusion list covering the CIS region, which the operators can switch off with a flag.

Who found it, and how

The research came from Group-IB’s threat intelligence team and NyxLab, working jointly. Group-IB says its findings draw on the operators’ “exposed tooling”, including AdaptixC2 build notes and a deployment guide, plus underground forum posts. However, the report does not explain how the team got hold of that tooling. We found no statement that it came from an open directory, so we are not claiming one.

Confirmed vs reported

FortiBleed is a separate credential-harvesting campaign against FortiGate devices. SOCRadar reported it in June 2026, and the FBI warned in October that it was still active. Notably, SOCRadar said India and the US together accounted for nearly a third of FortiBleed entries. Therefore Indian FortiGate owners have two reasons to rotate credentials, not one.

Am I affected by the VPN credentials leak?

You are in scope if any of these devices faces the internet. Fixed versions below come from the vendor advisories.

Pick the hotfix on your own PAN-OS branch from the Palo Alto advisory. Note that the GlobalProtect bug only applies when authentication override cookies are enabled with a particular certificate setup. Check under Network > GlobalProtect > Portals and Gateways, on the authentication override settings.

How to fix it

1. Patch and lock down management

First, upgrade FortiWeb and PAN-OS to the versions above. If you cannot patch FortiWeb today, Fortinet’s workaround is to disable HTTP and HTTPS admin access on internet-facing interfaces. For GlobalProtect, Palo Alto’s workarounds are to disable authentication override, or to use a dedicated certificate for those cookies only.

Then restrict every admin interface to your office or management network. On FortiGate, set trusted hosts for each admin under System > Administrators. Also raise the admin lockout. Fortinet’s default is 60 seconds, which is exactly the pause the k0t script was built to wait out. This command comes from Fortinet’s documentation (not tested by us on hardware):

config system global
    set admin-lockout-duration 600
end

2. Protect stored secrets

Next, stop configs from giving up their passwords. Fortinet’s FG-IR-19-007 advisory gives this setting. When you enable it on older builds, FortiOS asks for a 32-digit hex key. From 7.6.1 it generates the key itself. Read Fortinet’s HA notes before you change a cluster.

config system global
    set private-data-encryption enable
end

3. Rotate credentials in the right order

After a VPN credentials leak of this kind, assume that anything stored on an exposed box is known. Change the LDAP/AD bind account password first, because that is the route into Active Directory. In addition, use a low-privilege account for the bind. After that, reset local admin passwords and VPN user passwords. Finally, remove local VPN accounts where users can authenticate through your directory with MFA instead.

Check whether you were already compromised

Group-IB’s own advice is to treat this VPN credentials leak as intrusion response, not just patching. So do these checks before you clean anything up.

• Open System > Administrators on each FortiGate. Question every account you cannot tie to a change request. A random eight-letter name with prof_admin matches the k0t pattern.
• Review admin and VPN login events for sources outside India or your usual ISPs.
• On FortiGate, Fortinet documents this command to show the source IPs of failed admin logins:

diagnose alertconsole list

• On endpoints, look for MeshAgent, AnyDesk, Atera, Teramind or ngrok that IT did not install.
• After patching GlobalProtect, users must re-authenticate once anyway. Even so, review active sessions and end any you do not recognise.

If you have a plain-text config backup, this script lists each admin with its profile and trusted hosts. We tested it with sh, bash -n and shellcheck against a sample config. It only reads the file.

#!/bin/sh
# Usage: sh fgt-admins.sh backup.conf
awk '
  /^config system admin$/ {inblk=1; next}
  inblk && /^end$/ {inblk=0}
  inblk && /^    edit / {print ""; print "admin:", $2}
  inblk && /set (accprofile|trusthost[0-9]+) / {print "  ", $0}
' "$1"

An admin with no trusthost lines can log in from any address. Encrypted backups will not be readable this way.

Published IOCs

These network indicators come from the Group-IB report (defanged there; plain here so grep works). The report also lists 21 file hashes. A clean result does not prove you are safe.

mesh.buttruyen.com
62.60.131.43
meshcentral.girydsfsggvb.com
62.60.135.64
agent.afahimsa.top
193.149.187.81
64.94.85.14
168.100.11.99
162.33.178.213
sthyjk.com
162.33.179.249
193.24.123.162
193.149.176.50
radesashar.com
193.169.194.21
alknene.shop

Save the list as k0t-iocs.txt and search exported firewall, proxy and DNS logs. We tested this against sample log lines:

grep -r -i -n -w -F -f k0t-iocs.txt /path/to/exported-logs/

AdaptixC2 beacons used port 4321. Group-IB also notes the team server certificate kept the default subject “O=Internet Widgits Pty Ltd”.

India angle: reporting duties

If you find a backdoor admin or IOC hits, the CERT-In Directions of 28 April 2022 apply. Covered entities, which include body corporates, must report cyber incidents to CERT-In within six hours of noticing them. Data breaches and data leaks are on the reportable list, so preserve logs before you wipe or rebuild anything.

The DPDP angle needs care. Rule 7 of the DPDP Rules 2025 requires notice to affected people and the Data Protection Board, with a detailed report within 72 hours. However, that rule applies only from May 2027, so it is not yet in force today. Even so, if staff or customer data left through Rclone, plan your notices now. Contractual duties to clients may also apply.

Quick checklist

• ☐ List every internet-facing FortiGate, FortiWeb and GlobalProtect device
• ☐ Upgrade FortiWeb past CVE-2025-64446 and PAN-OS past CVE-2026-0257
• ☐ Remove admin pages from the internet; set trusted hosts on every admin
• ☐ Increase admin-lockout-duration above the 60-second default
• ☐ Enable private-data-encryption on FortiGate
• ☐ Rotate the LDAP/AD bind account, then admin and VPN passwords
• ☐ Enforce MFA on all VPN and admin logins
• ☐ Delete unknown admins, especially prof_admin accounts with no trusted host
• ☐ Search logs for the Group-IB IOCs and unknown remote-access tools
• ☐ Preserve logs and report to CERT-In within six hours if you find a compromise

If you want help checking your exposure to the VPN credentials leak, our VAPT services include external testing of firewall and VPN exposure. For broader hardening, see our ISO 27001 readiness assessment. For context on the wider month’s incidents, read our Black October 2026 fact check.

Sources

• Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (21 Oct 2026)
• The Hacker News: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials (23 Oct 2026)
• Fortinet PSIRT FG-IR-25-910 (CVE-2025-64446)
• Palo Alto Networks advisory CVE-2026-0257
• Fortinet PSIRT FG-IR-19-007 (CVE-2019-6693)
• BleepingComputer: GlobalProtect auth bypass now exploited
• The Hacker News: FBI warns FortiBleed remains active
• SOCRadar: FortiBleed analysis

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.