Group-IB and NyxLab say attackers entered organisations worldwide through exposed network devices, with some intrusions leading to persistent remote access and data theft.
A campaign targeting internet-facing enterprise firewalls and virtual private network (VPN) systems exposed more than 70,000 credentials and gave attackers persistent access to some organisations, according to a joint investigation by Group-IB and NyxLab. The Hacker News reported the findings on October 23, 2026.
The disclosure follows compromises that occurred in significant numbers between February and June 2026. Researchers attribute the campaign to an actor using the name k0t and say it affected organisations worldwide across multiple sectors.
The reported targets included Fortinet FortiGate and Palo Alto Networks GlobalProtect devices. These systems sit at the boundary between an organisation’s network and the internet. Firewalls control network traffic, while VPNs provide remote connections to internal systems.
According to the investigation, attackers searched for exposed devices at scale, then tried known software vulnerabilities or common username-and-password combinations. The researchers said a device’s product and location appeared to matter more to target selection than the organisation’s industry.
After gaining entry, attackers used VPN connections to reach internal systems, examined the networks and stole more credentials. They installed remote-access software to maintain access and transferred stolen data to cloud storage, the researchers said. The exposure therefore extended beyond the initial firewall or VPN breach to systems and information inside affected organisations.
The more than 70,000 exposed credentials—login details—were associated with network devices and copied organisational directory data, described as LDAP dumps. The figure counts credentials, not affected organisations.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Researchers assessed possible links between k0t and the ransomware groups Qilin and The Gentlemen because many campaign victims later appeared on those groups' data-leak sites. The exact relationship remains unclear; those listings do not establish what role k0t played in the ransomware operations.
The February–June activity also overlapped in time with the credential-theft campaign known as FortiBleed. Group-IB and NyxLab said they found negligible overlap between the compromised datasets. They left open whether the findings represented a separate dataset, a subset of operators or a related access operation within the broader FortiBleed activity.
Affected software versions and applicable patch releases remain unspecified. Group-IB and NyxLab advise organisations to remedy the vulnerabilities identified in the investigation.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
