# k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign Targeting FortiGate, FortiWeb and GlobalProtect (CVE-2025-64446, CVE-2026-0257)

> Group-IB and NyxLab report that k0t (aliases CryptoFeel, Member19; collaborator Scrooge/ScroogeMcDuck) compromises Fortinet FortiGate/FortiWeb and Palo Alto GlobalProtect edge devices via brute-forced or exposed credentials and exploitation of CVE-2025-64446 and CVE-2026-0257, then moves laterally in hands-on-keyboard activity, persists with MeshCentral/AdaptixC2/RMM tools and exfiltrates data with Rclone. Group-IB assesses k0t likely acts as an initial access broker, with victim-listing overlap with Qilin and The Gentlemen ransomware groups.

- **Published:** 2026-10-21T07:59:19Z
- **Last reviewed:** 2026-10-23T15:00:16.515Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4023
- **ID:** TL-2026-4023
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-64446, CVE-2026-0257, CVE-2021-42278, CVE-2021-42287, CVE-2019-6693

## Description

Group-IB Threat Intelligence and NyxLab describe a large-scale campaign of vulnerability exploitation and brute-forcing of exposed network devices (Fortinet FortiGate, Fortinet FortiWeb and Palo Alto Networks GlobalProtect). FortiGate compromises were observed between February and June 2026 and overlap with the cluster Group-IB tracks as FortiBleed, although credential overlap between the two is negligible. The operator dataset contains over 70,000 exposed credentials, including LDAP dumps. Target discovery relied on public scanning services (FOFA, ZoomEye, Censys); forum posts show requests for a premium FOFA account or on-demand IP exports, with priority on the United States and Canada, then Europe.

Initial access tooling includes a Python 'FortiGate Security Scanner' (fort.py / fortnew.py, developer tag SCRIPT_DEV = BH, script version 2025-12-08) that takes ip:port lists, runs 10 worker threads by default (up to 50 observed), hard-excludes the CIS region unless --no-exclude is passed, and replicates FortiGate's 60-second lockout behaviour. Common credential pairs include users admin, fortinet, fgtsecure, sysadmin with passwords admin, fortigate, F0rt!n3t123, P@ssw0rd123. A second tool, exploit_2026_0257.py (developer tag BeiDou), forges a GlobalProtect authentication-override cookie ('admin;;Windows;;[TIMESTAMP];0.0.0.0') encrypted with the portal TLS certificate public key and then establishes an OpenConnect VPN session, abusing CVE-2026-0257 (CWE-565, reliance on cookies without validation and integrity checking). CVE-2025-64446 is a FortiWeb relative path traversal that lets an unauthenticated attacker reach the fwbcgi CGI component (POST to /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi) and create an administrator account; it has been exploited since at least early October 2025. CVE-2019-6693 (FortiGate default AES key for stored secrets) is used to recover secrets from exported configurations.

After gaining edge access the operators reach the internal network and perform hands-on-keyboard activity: SMB enumeration and credential dumping with NetExec (SAM, LSA, LSASS, DPAPI, atexec/smbexec execution), Impacket GetUserSPNs and secretsdump, Kerbrute password spraying, PetitPotam coercion with NTLM relay, Mimikatz, SoftPerfect network scanning and the noPac chain (CVE-2021-42278 / CVE-2021-42287) for Domain Admin. Persistence uses attacker-run MeshCentral servers with agentAutoApprove/agentAutoCreateDevice enabled (28 active device groups with 84 devices, plus about 100 removed groups), AdaptixC2 team servers (default port 4321, listeners /update, /api/v1/check, /uri.php, operator accounts operator1/operator2) and commercial RMM tools (Atera, Teramind, AnyDesk, ngrok). Data is exfiltrated with Rclone to Wasabi S3 buckets and MEGA.

Victimology (unique domains) is led by Asia-Pacific at 37.6%, with significant Latin America presence and North America and Europe following; Group-IB notes this reflects exposure of misconfigured devices found through scanning rather than deliberate sector targeting. Attribution is low confidence: k0t is the likely main operator, CryptoFeel and Member19 are potential aliases, Scrooge/ScroogeMcDuck is a collaborator who acquired tools, and BeiDou and BH are tool developers with unconfirmed relationships. Group-IB observed victim-listing overlap with Qilin and The Gentlemen ransomware groups and assesses k0t likely operates as an initial access broker, a relationship it has not confirmed. Separately, public reporting on 2026-07-20 states Qilin affiliates are exploiting CVE-2026-0257.

## MITRE ATT&CK

- T1596.005 Scan Databases
- T1583.001 Domains
- T1588.002 Tool
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078.003 Local Accounts
- T1136.001 Local Account
- T1110.003 Password Spraying
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1558.003 Kerberoasting
- T1187 Forced Authentication
- T1550.002 Pass the Hash
- T1569.002 Service Execution
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1595.002 Vulnerability Scanning
- T1583.003 Acquire Infrastructure
- T1078 Valid Accounts
- T1110.001 Brute Force
- T1552.001 Unsecured Credentials
- T1105 Ingress Tool Transfer
- T1071.001 Application Layer Protocol

## Sources

- [Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (Group-IB)](https://www.group-ib.com/blog/stray-cat-network-edge/)
- [Palo Alto Networks Security Advisory CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257)
- [Arctic Wolf Security Bulletin: CVE-2025-64446 (FortiWeb)](https://arcticwolf.com/resources/blog/cve-2025-64446/)
- [Hackers are exploiting Palo Alto GlobalProtect VPN authentication bypass (CVE-2026-0257) - Help Net Security](https://www.helpnetsecurity.com/2026/06/01/hackers-are-exploiting-palo-alto-globalprotect-vpn-authentication-bypass-cve-2026-0257/)
- [Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks - BleepingComputer](https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/)
- [CISA Warns of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) - Qualys ThreatPROTECT](https://threatprotect.qualys.com/2026/06/01/cisa-warns-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257)
- [Horizon3.ai attack research: CVE-2026-0257](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-0257/)
- [CSA Singapore Alert AL-2026-064: Critical Vulnerability in Palo Alto Networks Products](https://csa.gov.sg/alerts-and-advisories/alerts/al-2026-064)
- [Indusface: CVE-2025-64446 Critical FortiWeb Path Traversal Under Active Exploitation](https://docs.indusface.com/en/article/cve-cve-2025-64446-critical-fortiweb-path-traversal-vulnerability-under-active-exploitation)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4023