🤖 Group-IB and NyxLab tie a campaign against exposed FortiGate and Palo Alto GlobalProtect edge devices to actor k0t (CryptoFeel, Member19), likely an initial access broker for Qilin and The Gentlemen. 70,000+ credentials exposed, peak activity Feb-Jun 2026, with persistent access and exfiltration attempts.
🔗 https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
#InfoSec #CyberSec #Fortinet #PaloAlto
The Hacker NewsHackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 CredentialsA campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.