A threat actor known as k0t scans the internet for exposed firewalls and VPNs, breaks into the ones it finds and collects credentials at scale. Researchers at Group-IB and NyxLab counted more than 70,000 stolen logins, and 31.9% of victims are in Latin America.
Who k0t is and where it hits
The actor, also appearing as CryptoFeel and Member19, was first seen on October 22, 2025. According to The Hacker News, the researchers believe it has links to the Qilin and The Gentlemen ransomware groups, possibly as an initial access broker or affiliate.
By region, victims split like this: Asia Pacific, about 38%; Latin America, 31.9%; Europe, 15.8%; Middle East and North Africa, 12.7%. Many attacks took place between February and June 2026. A line from the researchers explains the choice of targets: the product and location of the exposed device seem to matter more than the victim’s industry.
The way in
The routine starts with search engines such as FOFA and ZoomEye, which list internet-connected devices. The main targets are Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. To get in, the group exploits known flaws, such as CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS and Prisma Access, and also tries common username and password combinations.
Inside the network, the intruder maps Active Directory, hunts for more credentials and installs legitimate remote access tools, such as MeshCentral and Atera, to keep coming back. Data leaves through Rclone to cloud services like Wasabi and MEGA.
What it means if you do not run a company
The report covers corporate networks and does not discuss ordinary user accounts. But the lesson reaches anyone who runs a small office, a clinic or a shop: the router, firewall and VPN facing the internet are the storefront of the business, and weak passwords and unpatched software are what automated attacks look for.
How to protect yourself
- Update your firewall, VPN and router as soon as the vendor releases a fix, especially the Fortinet and Palo Alto products named in the report.
- Change default and weak passwords on any internet-facing equipment, and use a different one for each.
- Turn on two-step verification for VPN access.
- Do not leave admin panels open to the whole internet. Limit access by address or use the VPN.
- Be wary of remote access tools you did not install. If you find one, investigate before deleting it.
