Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Summary: Group-IB and NyxLab disclosed a large-scale campaign targeting exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, attributed to a threat actor known as k0t (aliases CryptoFeel, Member19, and QazWsxShop) first seen on October 22, 2025. More than 70,000 exposed credentials tied to network devices and LDAP dumps were identified, with 38% of victims in Asia Pacific, 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa, and a significant chunk of compromises occurring between February and June 2026.
Key Takeaway: The actor selects targets by enumerating exposed appliances at scale rather than researching individual organizations, so device type and location matter more than industry - and the campaign has already produced persistent remote access and data exfiltration at numerous organizations, with victims later appearing on Qilin and The Gentlemen leak sites.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026