k0t Edge Device Campaign Exploits Fortinet and Palo Alto

A financially motivated threat actor tracked as k0t (also known as CryptoFeel, Member19, and QazWsxShop) has targeted internet-facing Fortinet and Palo Alto Networks appliances in a large-scale credential harvesting campaign. Active primarily between February and June 2026, the actor has exposed over 70,000 credentials from enterprise firewalls, VPN gateways, and LDAP directories. The campaign operates as a high-volume initial access operation, with significant victim overlap observed on the leak sites of the Qilin and The Gentlemen ransomware groups.

The attack chain involves automated reconnaissance using FOFA and ZoomEye to identify vulnerable firmware, followed by exploitation of path traversal (CVE-2025-64446) and authentication bypass (CVE-2026-0257) vulnerabilities. In cases where exploits fail, the actor utilizes brute-force attacks against common credentials. Once a foothold is established via OpenConnect VPN, the actor deploys a variety of legitimate remote management tools and the AdaptixC2 framework to maintain persistence and exfiltrate data to cloud storage providers like Wasabi and MEGA.

This campaign underscores the critical risk posed by unpatched edge infrastructure. By compromising the perimeter, k0t bypasses traditional security controls, treating subsequent malicious activity as legitimate VPN traffic. Organizations in APAC, Latin America, and North America have been heavily targeted, emphasizing that any organization with exposed, unpatched appliances is at immediate risk of extortion.