Threat reportThreat IntelligenceTL-2026-4023
k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign Targeting FortiGate, FortiWeb and GlobalProtect (CVE-2025-64446, CVE-2026-0257)
k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign (TL-2026-4023), also tracked as Stray Cat network-edge campaign, is a high-severity tracked intrusion set, first published 2026-10-21 and last reviewed 2026-10-23. It has no confirmed attribution, affects Fortinet FortiWeb, references 5 CVEs (CVE-2025-64446, CVE-2026-0257, CVE-2021-42278), maps to 25 MITRE ATT&CK techniques (T1003.001, T1003.002, T1046), and is covered by 9 detection rules and 34 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 34Indicators of compromise
Key facts for TL-2026-4023
- Threat ID
- TL-2026-4023
- Also known as
- Stray Cat network-edge campaign, FortiBleed (overlapping cluster)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- multiple industries
- Target regions
- Asia Pacific, Latin America, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 34
- Updates
- 2026-10-23 · revalidated 1× · latest source
Malware and tooling in k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign
Malware and tooling: AdaptixC2, AnyDesk, AdaptixC2, Atera, Impacket - S0357, MeshCentral, MeshCentral/MeshAgent, Rclone - S1040, ngrok - S0508
How k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign works
Group-IB and NyxLab report that k0t (aliases CryptoFeel, Member19; collaborator Scrooge/ScroogeMcDuck) compromises Fortinet FortiGate/FortiWeb and Palo Alto GlobalProtect edge devices via brute-forced or exposed credentials and exploitation of CVE-2025-64446 and CVE-2026-0257, then moves laterally in hands-on-keyboard activity, persists with MeshCentral/AdaptixC2/RMM tools and exfiltrates data with Rclone. Group-IB assesses k0t likely acts as an initial access broker, with victim-listing overlap with Qilin and The Gentlemen ransomware groups.
Group-IB Threat Intelligence and NyxLab describe a large-scale campaign of vulnerability exploitation and brute-forcing of exposed network devices (Fortinet FortiGate, Fortinet FortiWeb and Palo Alto Networks GlobalProtect). FortiGate compromises were observed between February and June 2026 and overlap with the cluster Group-IB tracks as FortiBleed, although credential overlap between the two is negligible. The operator dataset contains over 70,000 exposed credentials, including LDAP dumps. Target discovery relied on public scanning services (FOFA, ZoomEye, Censys); forum posts show requests for a premium FOFA account or on-demand IP exports, with priority on the United States and Canada, then Europe.
Initial access tooling includes a Python 'FortiGate Security Scanner' (fort.py / fortnew.py, developer tag SCRIPT_DEV = BH, script version 2025-12-08) that takes ip:port lists, runs 10 worker threads by default (up to 50 observed), hard-excludes the CIS region unless --no-exclude is passed, and replicates FortiGate's 60-second lockout behaviour. Common credential pairs include users admin, fortinet, fgtsecure, sysadmin with passwords admin, fortigate, F0rt!n3t123, P@ssw0rd123. A second tool, exploit_2026_0257.py (developer tag BeiDou), forges a GlobalProtect authentication-override cookie ('admin;;Windows;;[TIMESTAMP];0.0.0.0') encrypted with the portal TLS certificate public key and then establishes an OpenConnect VPN session, abusing CVE-2026-0257 (CWE-565, reliance on cookies without validation and integrity checking). CVE-2025-64446 is a FortiWeb relative path traversal that lets an unauthenticated attacker reach the fwbcgi CGI component (POST to /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi) and create an administrator account; it has been exploited since at least early October 2025. CVE-2019-6693 (FortiGate default AES key for stored secrets) is used to recover secrets from exported configurations.
After gaining edge access the operators reach the internal network and perform hands-on-keyboard activity: SMB enumeration and credential dumping with NetExec (SAM, LSA, LSASS, DPAPI, atexec/smbexec execution), Impacket GetUserSPNs and secretsdump, Kerbrute password spraying, PetitPotam coercion with NTLM relay, Mimikatz, SoftPerfect network scanning and the noPac chain (CVE-2021-42278 / CVE-2021-42287) for Domain Admin. Persistence uses attacker-run MeshCentral servers with agentAutoApprove/agentAutoCreateDevice enabled (28 active device groups with 84 devices, plus about 100 removed groups), AdaptixC2 team servers (default port 4321, listeners /update, /api/v1/check, /uri.php, operator accounts operator1/operator2) and commercial RMM tools (Atera, Teramind, AnyDesk, ngrok). Data is exfiltrated with Rclone to Wasabi S3 buckets and MEGA.
Victimology (unique domains) is led by Asia-Pacific at 37.6%, with significant Latin America presence and North America and Europe following; Group-IB notes this reflects exposure of misconfigured devices found through scanning rather than deliberate sector targeting. Attribution is low confidence: k0t is the likely main operator, CryptoFeel and Member19 are potential aliases, Scrooge/ScroogeMcDuck is a collaborator who acquired tools, and BeiDou and BH are tool developers with unconfirmed relationships. Group-IB observed victim-listing overlap with Qilin and The Gentlemen ransomware groups and assesses k0t likely operates as an initial access broker, a relationship it has not confirmed. Separately, public reporting on 2026-07-20 states Qilin affiliates are exploiting CVE-2026-0257.
MITRE ATT&CK techniques used in TL-2026-4023
Credential Access
T1003.001 LSASS Memory; T1003.002 Security Account Manager; T1110.001 Brute Force; T1110.003 Password Spraying; T1187 Forced Authentication; T1552.001 Unsecured Credentials; T1558.003 Kerberoasting
Discovery
T1046 Network Service Discovery; T1135 Network Share Discovery
Command and Control
T1071.001 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1078.003 Local Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
Lateral Movement
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Execution
Resource Development
T1583.001 Domains; T1583.003 Acquire Infrastructure; T1588.002 Tool
Reconnaissance
Affected products and versions in k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign
- Fortinet — FortiWeb
Vulnerable versions: 8.0.0-8.0.1; 7.6.0-7.6.4; 7.4.0-7.4.9; 7.2.0-7.2.11; 7.0.0-7.0.11
Fixed in: 8.0.2+; 7.6.5+; 7.4.10+; 7.2.12+; 7.0.12+ - Fortinet — FortiGate
Vulnerable versions: Exposed management interfaces / weak or default credentials; CVE-2019-6693 default key for stored secrets
Fixed in: Enable private-data-encryption with operator-defined key; rotate credentials - Palo Alto Networks — PAN-OS GlobalProtect (portal/gateway) and Prisma Access
Vulnerable versions: 12.1 < 12.1.4-h6, < 12.1.7; 11.2 < 11.2.4-h17, < 11.2.7-h14, < 11.2.10-h7, < 11.2.12; 11.1 < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15; 10.2 < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6
Fixed in: Per Palo Alto Networks advisory CVE-2026-0257; Cloud NGFW and Panorama unaffected - Microsoft — Active Directory Domain Services (noPac, CVE-2021-42278/CVE-2021-42287)
Vulnerable versions: Domain controllers without the November 2021 security updates
Fixed in: November 2021 security updates and later
Remediation for k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign
Patches
- FortiWeb 8.0.2+, 7.6.5+, 7.4.10+, 7.2.12+, 7.0.12+ for CVE-2025-64446
- PAN-OS fixed releases per Palo Alto Networks advisory CVE-2026-0257 (e.g. 12.1.4-h6/12.1.7, 11.2.12, 11.1.15, 10.2.18-h6); users must re-authenticate after upgrade
- Apply Microsoft updates addressing CVE-2021-42278 and CVE-2021-42287 on domain controllers
Immediate actions
- Remove FortiGate, FortiWeb and GlobalProtect management interfaces from direct internet exposure and restrict administration to trusted networks
- Rotate all credentials stored in or exposed by edge device configurations, prioritizing LDAP/AD bind and service accounts
- Disable GlobalProtect Authentication Override or use a dedicated certificate exclusively for authentication override cookies
- Hunt for unexpected local admin creation, configuration exports, repeated authentication failures and lockout-retry patterns on edge devices
- Hunt for unsanctioned RMM tools (MeshAgent, Atera, Teramind, AnyDesk, ngrok), AdaptixC2 and Rclone transfers to Wasabi/MEGA
Workarounds
- Disable HTTP/HTTPS on internet-facing FortiWeb management interfaces until patched
- Disable Authentication Override in the GlobalProtect portal configuration
Longer-term hardening
- Enforce MFA on all applicable accounts, including VPN and administrative access
- Enable FortiGate private-data-encryption with an operator-defined key
- Maintain continuous external attack-surface visibility for edge devices
- Audit service accounts excluded from routine credential rotation
CVEs associated with k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign
CVE-2025-64446, CVE-2026-0257, CVE-2021-42278, CVE-2021-42287, CVE-2019-6693
Weaknesses (CWE) in k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign
Timeline of k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign
- Exploitation of FortiWeb CVE-2025-64446 observed since at least early October 2025 (exact day not stated in sources).
- Threat actor k0t first observed, per The Hacker News summary of the Group-IB/NyxLab report.
- Fortinet publicly discloses CVE-2025-64446, a FortiWeb relative path traversal enabling unauthenticated administrative command execution; fixed in 8.0.2, 7.6.5, 7.4.10, 7.2.12 and 7.0.12.
- Version string of k0t's FortiGate Security Scanner script (fort.py / fortnew.py) dated 2025-12-08.
- Start of the February-June 2026 period in which Group-IB observed FortiGate compromises by k0t, overlapping the FortiBleed cluster (day approximated to month start).
- Palo Alto Networks publishes advisory for CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass (CWE-565).
- Earliest observed exploitation of CVE-2026-0257 against GlobalProtect.
- Second wave of CVE-2026-0257 exploitation, believed to be the same actor.
- Palo Alto Networks confirms active exploitation of CVE-2026-0257; the CVE is added to the CISA KEV catalog.
- Public reporting (Help Net Security, Qualys) that CVE-2026-0257 is being exploited against unpatched devices; Palo Alto Networks raises severity to High.
- FortiBleed FortiGate credential-exposure campaign reported publicly (CSA Singapore, Bitdefender and others); Group-IB later assessed k0t activity as related with moderate confidence.
- Researchers report Qilin ransomware affiliates actively exploiting CVE-2026-0257.
- Group-IB Threat Intelligence and NyxLab publish 'Stray Cat, Open Doors' detailing k0t's network-edge campaign, tooling and infrastructure.
- The Hacker News reports 70,000+ exposed credentials and links to Qilin and The Gentlemen leak-site victims.
Update history for TL-2026-4023
- 2026-10-23 — k0t Actor Breaches Fortinet FortiGate/FortiWeb and Palo Alto GlobalProtect Firewalls/VPNs, Exposing 70,000+ Credentials (CVE-2025-64446, CVE-2026-0257): What changed No severity, exploitability, status or attribution field changes. Severity HIGH and exploitability ACTIVE already reflect the evidence, and the newer report only restates the reasoning behind CRITICAL, with no new evidence. New
Sources cited for k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign
- Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (Group-IB)
- Palo Alto Networks Security Advisory CVE-2026-0257
- Arctic Wolf Security Bulletin: CVE-2025-64446 (FortiWeb)
- Hackers are exploiting Palo Alto GlobalProtect VPN authentication bypass (CVE-2026-0257) - Help Net Security
- Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks - BleepingComputer
- CISA Warns of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) - Qualys ThreatPROTECT
- Horizon3.ai attack research: CVE-2026-0257
- CSA Singapore Alert AL-2026-064: Critical Vulnerability in Palo Alto Networks Products
- Indusface: CVE-2025-64446 Critical FortiWeb Path Traversal Under Active Exploitation
Detection coverage for TL-2026-4023
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4023 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4023
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.