k0t Hackers Expose 70,000 Credentials as Ransomware Concerns Grow

A large-scale cyberattack campaign linked to the threat actor k0t has exposed more than 70,000 credentials, raising concerns about corporate network security and ransomware threats. The operation targeted vulnerable firewalls and remote-access systems used by businesses worldwide.

Cybersecurity researchers from Group-IB and NyxLab disclosed the findings on October 21, 2026. Their investigation suggests attackers established persistent access to compromised networks, potentially creating opportunities for ransomware operators.

Attackers Exploit Corporate Network Vulnerabilities

The k0t campaign targeted internet-facing security products, including Fortinet FortiGate firewalls, FortiWeb systems, and Palo Alto Networks GlobalProtect gateways.

Attackers combined password attacks with exploitation of known security vulnerabilities. These included CVE-2025-64446 affecting FortiWeb and CVE-2026-0257 affecting certain GlobalProtect configurations.

After gaining entry, the operators extracted stored credentials and directory information. They also used OpenConnect VPN connections, remote-management software, and AdaptixC2 to maintain access.

Researchers identified more than 70,000 exposed credentials and related records. However, that figure does not establish that every credential remained valid or resulted in a successful intrusion.

Possible Connections to Ransomware Operations

Investigators discovered that some affected organizations later appeared on ransomware leak sites associated with Qilin and The Gentlemen.

The findings suggest k0t could operate as an initial access broker, obtaining unauthorized network access for other criminal groups. However, researchers have not confirmed any direct relationship between the campaign and those ransomware operators.

The investigation also identified similarities with FortiBleed, an earlier campaign involving compromised Fortinet credentials.

Despite those similarities, researchers found minimal overlap between the credential datasets. Consequently, they could not establish whether the same operators controlled both campaigns.

Financial and Crypto Businesses Face Security Risks

The investigation found that Asia-Pacific accounted for 37.6% of unique domains in the exposed dataset. Researchers cautioned that this distribution does not necessarily indicate deliberate regional targeting.

For financial institutions and cryptocurrency businesses, compromised network access presents significant operational risks. Attackers who obtain privileged credentials could potentially reach sensitive systems, disrupt services, or steal confidential information.

However, investigators have not established a direct connection between k0t and any cryptocurrency theft.

Security specialists recommend patching exposed devices, restricting administrative access, rotating compromised credentials, and reviewing suspicious VPN activity.

The findings highlight how weaknesses in widely deployed network infrastructure can create opportunities for broader cybercrime. As investigations continue, the suspected connection between credential theft and ransomware operations remains an important unresolved concern.