Group-IB and NyxLab published joint research into an actor tracked as k0t, who has collected more than 70,000 credentials tied to network devices and directory dumps. The actor is linked to the Qilin and The Gentlemen ransomware operations, probably as an access broker, and the researchers are careful to say the exact relationship is unclear.

What the chain looks like

Reconnaissance runs through FOFA and ZoomEye, the search engines that index exposed devices, looking for VPN and firewall appliances reachable from the internet.

Access comes from 2 named flaws — CVE-2025-64446, a path traversal in FortiWeb, and CVE-2026-0257, an authentication bypass in PAN-OS and Prisma Access — or from brute-forcing common username and password pairs, which still works often enough to be worth the traffic.

A foothold follows through an OpenConnect VPN connection, then enumeration of Active Directory, SMB shares and installed antivirus, then credential theft. Exfiltration runs through Rclone to Wasabi buckets and MEGA drives.

The victims track the device, not the sector

The regional split is 38% Asia Pacific, 31.9% Latin America, 15.8% Europe and 12.7% Middle East and North Africa, and the researchers draw the conclusion that matters: "the product and location of an exposed device therefore appear to matter more than the industry." No sector appears anywhere in that sentence.

Most threat reporting is organised by sector, because that is how buyers organise themselves. Healthcare reads the healthcare report. An actor working this way never looks at the sector. It looks at a scan result, and the scan result does not say what the company does.

Which means a small manufacturer in Latin America running the same appliance as a bank is in the same queue, and the sector-shaped briefing the bank reads does not describe either of them.

Legitimate tools, all the way down

Persistence is MeshCentral, Atera, Teramind and AnyDesk — remote access products a help desk would recognise — alongside the AdaptixC2 framework. Lateral movement uses NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz. That is 12 named tools, every one of them public, every one plausibly installed by an administrator.

Detection built on knowing bad binaries will not see this. Detection built on asking why a remote access agent appeared on a domain controller at 03:00 might.

Why the edge keeps being the answer

k0t was first seen in October 2025, with a significant share of the compromises falling between February and June 2026 — an 8-month run for one approach. The edge device is attractive because it is reachable by definition, because it holds credentials for the network behind it, and because it is least likely to be covered by the endpoint tooling the organisation pays for.

We made the same observation about an orchestrator where the lowest built-in role reached superuser.

The researchers note an overlap with a separate credential-harvesting campaign called FortiBleed, with what they describe as negligible overlap in the compromised data itself, and are careful not to merge the two.

What to do

  • Patch CVE-2025-64446 and CVE-2026-0257 if either applies, and check whether they were applied when you think they were.
  • Search for MeshCentral, Atera, Teramind and AnyDesk agents you did not deploy. Inventory the remote access tools you did.
  • Look for Rclone on anything that is not a backup server, and for outbound traffic to Wasabi and MEGA.
  • Assume any credential that transited an exposed appliance is public, and rotate on that basis rather than on evidence of theft.
  • Check what FOFA and ZoomEye already say about your own addresses. The attacker started there.

What is not established

  • How many organisations were compromised. The researchers say numerous, worldwide, and do not give a count.
  • Whether k0t is an access broker, an affiliate, or both.
  • Whether the credentials have been sold, used, or are still held.
  • The relationship with FortiBleed, which the researchers deliberately leave open.
  • How many of the 70,000 credentials are still valid.

Group-IB and NyxLab's report was not retrieved for this piece, and the detail above comes from the reporting of it.