Vulnerabilities · Identity
Hackers steal over 70,000 credentials from enterprise firewalls and VPNs
A cybercriminal group breached Fortinet and Palo Alto Networks devices, stealing more than 70,000 credentials worldwide. Attackers used known flaws and brute-force attacks to gain access, according to researchers.
Ross Grant2 min read
The short version
Hackers broke into network devices made by Fortinet and Palo Alto Networks, stealing more than 70,000 usernames and passwords from companies around the world. They used known security flaws and guessed weak passwords to get in. The stolen credentials could let attackers access sensitive company systems. Researchers recommend organisations patch affected devices as soon as possible.
By the numbers
- 70,000+credentials stolen in the campaignThe Hacker News
- 38%victims located in Asia Pacific regionThe Hacker News
- 31.9%victims located in Latin AmericaThe Hacker News
- 15.8%victims located in EuropeThe Hacker News
- 12.7%victims located in Middle East and North AfricaThe Hacker News
What happened?
A cybercriminal group breached Fortinet and Palo Alto Networks firewall and VPN devices, stealing over 70,000 credentials from organisations worldwide. The attackers used known vulnerabilities and brute-force attacks to gain access, according to researchers from Group-IB and NyxLab. The campaign ran mainly between February and June 2026. Only one outlet has reported these details so far.
Who is affected
Researchers from Group-IB and NyxLab say the campaign targeted organisations worldwide using Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. Victims come from a wide range of sectors, with no single industry singled out. The attacks were global: 38% of victims were in Asia Pacific, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa. The campaign ran mainly between February and June 2026, overlapping with another credential theft operation called FortiBleed. The researchers say the attackers picked targets based on exposed devices, not by researching individual companies.The Hacker News (opens in a new tab)
What was taken
The attackers stole more than 70,000 credentials, including usernames and passwords for network devices and LDAP (Lightweight Directory Access Protocol) dumps. These credentials could let attackers access internal systems and move further into company networks. The data was exfiltrated (taken out) using tools like Rclone, with storage on Wasabi S3 buckets and MEGA cloud drives.
How the attack worked
The threat actor, known as k0t (also called CryptoFeel, Member19, and QazWsxShop), used public scanning tools like FOFA and ZoomEye to find internet-facing VPN and firewall appliances. They filtered these lists by product and location to select targets. The attackers exploited known vulnerabilities, including CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass in Palo Alto Networks PAN-OS and Prisma Access), using custom Python scripts. They also tried brute-force attacks with common username and password combinations. Once inside, they used OpenConnect VPN to maintain access, then ran tools to steal more credentials and map out the network. Persistence was established using legitimate remote access tools such as MeshCentral Agent, Atera, Teramind, AnyDesk, and the open-source AdaptixC2 framework. The attackers also used administrator and penetration testing tools like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to deepen their access.
Who is behind it
Group-IB and NyxLab attribute the campaign to a threat actor called k0t. This actor is believed to have links to ransomware groups Qilin and The Gentlemen, as some victims later appeared on those groups' data leak sites. However, the exact relationship is unclear. The researchers suggest k0t may act as an initial access broker, selling access to other criminals.
The response
Group-IB and NyxLab advise organisations to patch any vulnerabilities mentioned in their report. They also note that there is little overlap between this campaign and FortiBleed, suggesting separate operations. No statements from Fortinet or Palo Alto Networks have been reported yet, and no official figures on financial losses or regulatory investigations have been released.
Why it matters
Network edge devices like firewalls and VPNs are often the first line of defence for organisations. If attackers gain access, they can steal credentials and move deeper into company networks, putting sensitive data at risk. This campaign shows the importance of patching known vulnerabilities and using strong, unique passwords.
Key points
- Over 70,000 credentials were stolen from Fortinet and Palo Alto Networks devices.
- Attackers used known vulnerabilities and brute-force attacks to gain access.
- Victims span multiple sectors and regions, with the largest share in Asia Pacific.
- The threat actor k0t may be linked to ransomware groups but mainly acts as an initial access broker.
- Researchers urge organisations to patch affected devices and review credential security.
Sources
The Hacker News
Reference
