TL;DR

what: Group-IB and NyxLab disclosed a campaign by the actor k0t that scans for exposed Fortinet and Palo Alto Networks edge appliances, then breaks in with CVE-2025-64446, CVE-2026-0257 or brute-forced logins.

impact: More than 70,000 credentials from network devices and LDAP dumps are exposed, and some victims suffered persistent access, data theft to Wasabi and MEGA, and later listings on the Qilin and The Gentlemen leak sites.

fix: Apply the Fortinet fix for CVE-2025-64446 and the Palo Alto Networks fix for CVE-2026-0257, rotate credentials on any exposed edge appliance and directory service, and enforce MFA on VPN access.

who: Any organization running internet-facing FortiGate, FortiWeb, PAN-OS GlobalProtect or Prisma Access, especially in North America, Europe and APAC, regardless of industry.

More than 70,000 credentials tied to enterprise firewalls, VPN gateways and LDAP directories have been exposed in a year-long campaign against internet-facing edge devices.…