Data Breach Update

Data Breach Update Alert: 70,000 Firewall Logins Exposed

By Nattapong Sukkasem · Published 2026-10-26 · Updated 2026-10-26.

TL;DR — Group-IB and NyxLab published a joint investigation on 21 October into an operator tracked as k0t, who has spent the past year working through internet-facing Fortinet and Palo Alto Networks appliances. More than 70,000 credentials drawn from network-device records and LDAP dumps have been identified, and many victims later surfaced on the Qilin and The Gentlemen leak sites. This data breach update matters less for the flaws involved — all published, one of them seven years old — than for the method: victims were chosen from commercial attack-surface search engines by product rather than by industry, and one successful login turned each firewall into a credential store.

Most breach reporting starts with a victim. This data breach update starts with a filter. According to the Group-IB and NyxLab write-up, published on 21 October and reported more widely on 23 October, the operator known as k0t — also seen as CryptoFeel, Member19 and QazWsxShop — built target lists in FOFA, ZoomEye and Censys, bought bulk exports in ip:port form from underground list services, and then ran a scanner against whatever came back. Sector did not enter into it. The researchers note that the regional skew — Asia-Pacific at 37.6% of identifiable victim domains — most likely reflects where exposed devices are, not where the operator meant to go.

Data breach update: the Palo Alto Networks headquarters campus in Santa Clara, California, vendor of the GlobalProtect VPN portals targeted in the k0t credential theft campaign against enterprise server infrastructure — The Palo Alto Networks headquarters campus, photographed in 2018. GlobalProtect portals were k0t's primary target set, reached through `CVE-2026-0257`, an authentication bypass affecting portals and gateways configured with authentication-override cookies.

Four ways in, none of them new

The campaign reads as a catalogue of things vendors have already fixed. Against FortiWeb, the operator used CVE-2025-64446, a relative path traversal reached at /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi with a forged CGIINFO header impersonating prof_admin. The tool then creates a local administrator with a random eight-character username, an identical password, the prof_admin profile and a trusted-host entry of 0.0.0.0/0 — an artefact any defender can go and look for today.

FortiGate is not vulnerable to that flaw, so the same scanner falls back to brute-forcing the REST API with a short list of guesses such as admin/fortigate and sysadmin/P@ssw0rd123. When the device replies with a lockout, the host is parked for exactly sixty seconds and requeued. Sixty seconds is the FortiGate default, which tells you the tooling was written by somebody who had read the manual.

The quietest step is the most damaging. With the --parse-configs flag the scanner downloads the appliance configuration and decrypts the stored secrets offline using the default FortiOS AES key — CVE-2019-6693, documented since 2019 and still effective on any device whose operator never enabled private-data-encryption. There is no zero-day vulnerability anywhere in this chain. There is a seven-year-old default that quietly converts one administrative login into the LDAP and Active Directory bind credentials written into that config.

Step	Product	Identifier	What it yields
Path traversal	FortiWeb	`CVE-2025-64446`	Unauthenticated admin command execution; attacker-created admin account
Credential guessing	FortiGate REST API	No CVE	Administrative session via default or common passwords
Config decryption	FortiOS	`CVE-2019-6693`	LDAP/AD bind accounts and local user secrets from the downloaded config
Auth bypass	PAN-OS GlobalProtect	`CVE-2026-0257`	Forged override cookie accepted at `/ssl-vpn/login.esp` with an empty password
Privilege escalation	Active Directory	`CVE-2021-42278` / `CVE-2021-42287`	Domain Administrator via noPac

The GlobalProtect route is more elegant. The operator's exploit_2026_0257.py encrypts the string admin;;Windows;;[TIMESTAMP];0.0.0.0 with the public key lifted from the target's own TLS certificate, posts it to /ssl-vpn/login.esp with an empty password, and the portal accepts it. OpenConnect then brings up a genuine VPN session. Nothing about the resulting connection looks forged from the inside; it is an authorised tunnel, established by a device that was asked politely.

Fortinet's FortiGate and FortiWeb lines account for most of the compromises Group-IB dates to February–June 2026. The window overlaps the separate FortiBleed credential-harvesting cluster, though the researchers found negligible overlap between the two credential sets.

The target list was a subscription, not a scan

The operational detail worth dwelling on is that k0t did not discover these organisations. It queried them. FOFA, ZoomEye and Censys continuously index the reachable internet by banner, TLS certificate and product fingerprint; a premium account turns that index into a filtered, paid export. k0t was observed shopping for exactly that, alongside underground IP-list services with names like AccessTracker and FortiSSL.

This inverts the usual economics. A DDoS attack costs its operator money for every hour it runs, which is why such campaigns are short and loud. Here the recurring cost is a search-engine subscription and a thread pool the researchers observed set to 50, while the compromises ran from February to June without anything resembling an event. The expensive part of attacking was outsourced years ago to companies that scan the internet as a product.

Which means exposure is a property you hold continuously, independent of whether anyone is currently attacking you. Your edge appliance is in those indexes right now, under the hostname you gave it and presenting the certificate you issued it, and the predictable naming conventions of corporate networks — vpn, remote, sslvpn, gp — do a great deal of the work.If you run your own DNS over HTTPS resolver, it sits in the same index as the VPN portal, under the same kind of name, answering on the same port 443. Knowing what the internet sees when it looks back at you is not a one-off audit; it is the same question asked on a schedule.

A rack-mounted Fortinet FortiGate 6501F firewall chassis showing management, console and SFP ports, the class of edge server infrastructure targeted for credential theft in the k0t campaign — A FortiGate 6501F chassis, with its dedicated `MGMT` ports visible at lower left beside the console interface. Group-IB's first hardening recommendation is that management consoles should not be reachable from the internet at all.

Why resolution is where this becomes visible

Once a tunnel is up, the toolkit is conventional: NetExec and Impacket for enumeration and secrets, Kerbrute for spraying, noPac for Domain Admin, PetitPotam to coerce a domain controller into authenticating to a relay. Persistence arrives as ordinary remote-management software — MeshCentral agents, Atera, Teramind, AnyDesk, ngrok — plus an AdaptixC2 team server on 64.94.85.14:4321, still carrying its default self-signed certificate.

Every one of those discovery tools has to find a domain controller before it can do anything, and none of them has to guess. Active Directory publishes the answer in DNS, in _ldap._tcp.dc._msdcs.<domain> and its siblings, and any host that can reach the internal resolver can ask. That is by design and it is not going to change. What it does hand defenders is a timestamp: a newly connected VPN client enumerating _msdcs service records within seconds of association is a query pattern that an ordinary laptop does not produce, and it appears in the resolver log before NetExec has touched a single share. Group-IB's own response guidance lists DNS logs among the artefacts to preserve before retention expires, which is an easy line to skim past and the wrong one to skim.

The exfiltration stage of this data breach update makes a similar point about cloud security. Data left these networks through Rclone to Wasabi S3 buckets and MEGA drives, with AdaptixC2 agents pulled from sthyjk[.]com and a MeshCentral controller at mesh[.]buttruyen[.]com. Not one of those is infrastructure the victim owned or configured, so no amount of tenant hardening touches them. The control that would have mattered is an egress policy covering consumer object storage and commodity remote-management domains — and resolution is the cheapest place to apply one, because every one of those destinations has to be looked up before it can be reached.

A network latency comparison of public DNS resolvers measured in the browser, the kind of baseline that makes an unexpected change in resolution behaviour obvious — A resolver comparison run from the browser. A **network latency** baseline is worth taking while things are normal, because it is what later tells you whether resolution behaviour on a network has actually changed.

What to check this week

Hunt the artefacts, not just the versions. On FortiWeb, look for administrator accounts with random eight-character names, the prof_admin profile and a trusted host of 0.0.0.0/0; in proxy and appliance logs, for requests containing %3f/../../../../../cgi-bin/fwbcgi.
Enable private-data-encryption on FortiGate. Without an operator-defined key the device falls back to the published default, and any config export is a credential disclosure.
Treat an exposed config as a breach of everything in it. Rotate the admin and local accounts, and the LDAP and AD bind accounts especially — patching the appliance does not change a password an attacker already decrypted.
Review GlobalProtect sessions, not just PAN-OS builds. An established tunnel can outlive the fix that closed the hole it came through.
Give every remote-management agent an owner. MeshAgent, Atera, Teramind, AnyDesk and ngrok instances are the IT security finding most often waved through as somebody else's deployment. Unexplained Rclone execution deserves the same scrutiny.
Audit what your names point at. A network diagnostic tool run against your own published hostnames shows the edge addresses the scanners have already indexed, and how DoH actually works is worth revisiting before you expose a resolver endpoint of your own.

A DNS server performance benchmark measuring encrypted resolver response times from the browser, used to compare public DoH endpoints against each other — A **DNS server performance** benchmark against public resolvers. Measuring the endpoints you actually depend on, rather than assuming them, is the same discipline as knowing which of your own services answer from the public internet.

What it means

The honest summary of this data breach update is that nothing in it was sophisticated. Four published flaws, a wordlist, a default encryption key and a credit card for a scanning service produced more than 70,000 credentials and a victim list long enough to feed two ransomware brands. Group-IB assesses the operators as initial access brokers and says plainly that the relationship with Qilin and The Gentlemen is unconfirmed; the 70,000 figure counts exposed credentials, not verified breaches, and not every listed organisation was compromised.

What generalises is the shape. Edge appliances are the one piece of server infrastructure that must be reachable from the internet to do its job, and they hold the credentials that reach everything that must not be. Attack-surface search engines have made finding them a query rather than a campaign, which removes the last practical reason an organisation is too small or too obscure to be worth the effort. The appliance that terminates your tunnels, authenticates your staff and resolves names for everyone behind it is simultaneously your perimeter and the most concentrated secret you own — and this month it was indexed, filtered and tried at a rate of fifty hosts at a time, by somebody who never needed to know your name.

Sources

Browse every DNS news article by month →

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: The Hacker News — Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials (2026-10-23).