A hacker known as k0t targeted exposed Fortinet and Palo Alto firewalls worldwide, and researchers tied the campaign to more than 70,000 exposed logins.
A criminal known as k0t has been breaking into company firewalls and remote access devices around the world, according to a joint report from security firms Group-IB and NyxLab. The researchers linked the campaign to more than 70,000 exposed logins. Some victims later appeared on websites run by ransomware gangs, where stolen data gets posted.
The attacks focused on internet-facing devices from Fortinet (FortiGate firewalls) and Palo Alto Networks (GlobalProtect). A firewall is the gatekeeper between a company's network and the internet. A VPN lets staff connect to that network from outside the office. If a criminal gets into one, they can often get much further in.
The researchers say k0t was first seen on October 22, 2025. Most break-ins happened between February and June 2026. After getting in, the attackers used real administrator and security testing tools to move deeper into company networks. In some cases they set up lasting remote access and copied data out.
Victims span many industries. The researchers say k0t seems to pick targets by scanning the internet for exposed devices, not by studying particular companies. The type of device and where it sits matter more than what the business does. Stated priorities start with the United States and Canada, then European countries and some Asia Pacific markets.
By region, nearly 38% of victims are in Asia Pacific, 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa. Businesses that do not run these Fortinet or Palo Alto devices facing the internet are not the focus of this campaign. The report does not say anyone else is safe from other attacks.
The researchers believe k0t has ties to the ransomware groups Qilin and The Gentlemen. Many victims were later listed on those gangs' leak sites. k0t may act as an initial access broker, meaning someone who breaks in and hands off or sells that access. The exact relationship is unclear.
The alert box above lists the steps. The short version: confirm your devices are fully updated, change passwords, add two-step login and check for signs of trespassing. Small businesses that rely on an outside IT provider should send that provider the questions today.
The researchers found very little overlap between this stolen data and another credential theft campaign called FortiBleed, which ran over the same months. They say this could be a separate dataset or a related operation. They urged organizations to fix the vulnerabilities named in their report.
If your business runs a Fortinet or Palo Alto firewall or VPN, ask your IT provider today whether it is fully updated and whether passwords were reset.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smartAMD's data center sales rose 97% in the third quarter, a sign of heavy demand for AI computing that could affect what businesses pay for tech.
Read more: AMD's data center sales nearly doubled, lifting record quarter
