k0t campaign exposes 70,000 credentials and possible ransomware access pipeline

Group-IB and NyxLab researchers found more than 70,000 network credentials tied to a campaign by the cyber threat group k0t, which also created backdoors into corporate networks. The attackers abused FortiGate passwords and exploited vulnerabilities tracked as CVE-2025-64446 in FortiWeb and CVE-2026-0257 in Palo Alto GlobalProtect gateways, devices that provide remote access to corporate systems. Some victims also suffered data theft, and many FortiGate compromises occurred between February and June 2026. Some of those victims later appeared on leak pages run by ransomware groups Qilin and The Gentlemen, suggesting but not verifying that k0t profits from compromised access.