K0t campaign exploits exposed edge devices to steal credentials and move

Cybersecurity researchers have documented a large-scale campaign that has exploited exposed network edge devices - in particular VPN and firewalls applications - to obtain initial access and move laterally within corporate networks. The actor attributed to this activity operates under the alias k0t (also known as CryptoFeel, Member19 and QazWsxShop) and, according to the joint investigation of Group-IB and NyxLab, it would have started to be visible since 22 October 2025. Researchers report concentrated commitments between February and June 2026, with more than 70,000 exposed credentials and victims distributed globally, predominantly Asia-Pacific (h.38%), Latin America (h.31.9%), Europe (h.15.8%) and MENA (h.12.7%).

Confirmed facts: the campaign is based on massive recognition of Internet-accessible devices by search engines of internet-of-things and metadata services (mentioned in the report: FOFA and ZoomEye), explores public vulnerabilities in specific equipment - including CVE-2025-64446 and CVE-2026-0257 according to the report - and uses both custom exploits (for example, scripts called "fortnew.py" and "exploit _ 2026 _ 0257.py") as brute force attacks to obtain credentials. After the initial intrusion, the attackers establish a VPN OpenConnect tunnel, steal credentials and data, deploy legitimate remote administration tools for persistence (MeshCentral Agent, Atera, Teramind, AnyDesk) and emulation / adversary frameworks (AdaptixC2), and exfilter information using Rclone to cloud storage such as Wasabi S3 and MEGA accounts.

Technically, the documented attack flow follows a repeatable pattern: 1) Mass discovery of devices with exposed panels or management services; 2) selection of targets by product and geolocation rather than by sector(i.e. the type of device is more important and is exposed than the victim's industry); 3) exploitation through known vulnerabilities or weak credentials and 4) extension of commitment by means of administrative tools and pentesting utilities to steal credentials from Active Directory / LDAP, move laterally and maintain persistent access. The use of legitimate profits (Impacket, Mimikatz, PetitPotam, Kerbrute, etc.) makes detection difficult because it generates "non-malicious" activity in the eyes of simple signatures.

Those who are affected and why it matters: unlike campaigns directed at specific organizations, this operation is broad and opportunistic. Operators prioritize exposed devices and, therefore, any company that has firewalls, VPN or WAF applications with Internet-accessible administrative interfaces is at risk - regardless of its sector. The correlation with subsequent listings in the filtration sites of groups of ransomware (Qilin, The Gentlemen) suggests that some accesses can end up being sold or reused by operators of ransomware, although the exact nature of the relationship between k0t and those groups is not certified.

Observing real consequences: LDAP credentials and braindumps commitment, presence of backdoors and remote administration agents installed, and data theft to cloud destinations. These actions may result in espionage, intellectual property leakage, operational interruption (if ransomware is deployed) and loss of regulatory compliance if personal information is filtered. The researchers also point out that, although there is temporary overlap with another campaign called FortiBleed, the overlapping of committed data is "negligable," which could indicate sets of credentials or subsets of independent operators within the same umbrella of illicit activity.

What is confirmed, what is estimated and what is uncertain: it is confirmed that there was exploitation of exposed devices, the use of the above-mentioned exploits and tools, and exfiltration to Wasabi / MEGA. It is a reasonable estimate, supported by artifacts, that k0t acts as an initial access broker or as an affiliate (i.e. not necessarily the final ansomware performer). The exact contractual or operational link between k0t and the listed Ransomware groups is uncertain: the investigations show victim coincidence but not public evidence of direct coordination or profit-sharing.

Specific and urgent recommendations for security managers and officials: 1) Immediate inventory and reduced exposure. Identify all border applications (VPN, firewalls, WAF) and check if your administrative ports are accessible from the Internet. Use defensive search on engines such as FOFA or ZoomEye with own accounts to discover your exposed assets and, if possible, remove public access or limit by IP lists. (FOFA: https: / / fofa.so ZoomEye: https: / / www.zoomeye.org).

(2) Plot and vulnerability mitigation. Apply the official patches and mitigations for the above-mentioned CVs and any other vulnerability in network applications immediately. Check the suppliers' notices (for example, Fortinet and Palo Alto Networks publish alerts and mitigation guides on their security portals): Fortinet: https: / / www.fortinet.com / support / product-security / security-advices, Palo Alto Networks: https: / / security.paloaltonetworks.com.

(3) Rotation of credentials and hardening. Disable exposed administrative accounts, force rotation of privileged credentials and enable multifactor authentication for administrative access. Review and implement robust passwords and blockage policy after failed attempts.

4) Detection and hunting of intrusions. Look for commitment indicators: unauthorized OpenConnect connections, processes / services associated with MeshCentral / Atera / Teramind / AnyDesk, Rclone executions, transfers to Wasabi or MEGA and atypical use of administration tools. Audit log for VPN, firewalls and proxys; examine LDAP and Kerberos / NTLM events for signs of PetitPotam / Kerbrute / Mimikatz. Implement detections for commands and invocation of the above-mentioned scripts if you have endpoint or network telemetry.

(5) Isolation and recovery. If you detect commitment, isolate the affected hosts, revoke committed credentials and review the integrity of domain controllers and backups. Consider restoration from clean copies if there is a suspicion of deep persistence. Documentally and preserve evidence for forensic analysis.

Finally, although the operation described prioritizes exposed devices rather than specific industries, their scale and use of legitimate tools require organizations to take a proactive approach: continuous inventory of public exposure, accelerated parking, strong authentication and monitoring of rich telemetry. Response teams should prepare specific playbooks for intrusions initiated by operation of edge devices and coordinate with suppliers and authorities if data leaks or connections are identified with ransomware networks.