Hackers Breach FortiGate, FortiWeb, and Palo Alto GlobalProtect to Steal Passwords

Internet-facing firewalls and VPN systems are being targeted in a campaign that seeks to harvest credentials and establish persistent access into corporate networks.

The activity focuses on FortiGate and FortiWeb devices from Fortinet and on Palo Alto Networks GlobalProtect portals. Once inside, the operators extract passwords stored in device configurations and use them to pivot further into victims’ environments.

Researchers from Group-IB and NyxLab attribute the campaign to an operator they call k0t. Their investigation found that organizations across multiple industries and regions were affected.

Group-IB and NyxLab identified more than 70,000 exposed credentials and related records, including network-device credentials and LDAP entries. The researchers emphasize that this number does not mean every listed credential resulted in a confirmed compromise.

Analysts from Group-IB, working with NyxLab, detailed the campaign and its techniques in a report published on October 21, 2026.

The report describes a broad, opportunistic campaign: operators scan for internet-facing network equipment, then attempt access by exploiting software flaws or trying weak or default passwords. Their findings include stolen credentials, evidence of persistent remote access and instances of data exfiltration.

Hackers are breaking into FortiGate, FortiWeb and Palo Alto GlobalProtect systems

Operators use public search services to locate internet-facing VPN portals and firewalls, then probe those systems for vulnerabilities and attempt to gain control.

Group-IB notes the campaign is not restricted to a single industry. The large number of devices exposed online and their configurations likely influence which organizations appear in the collected data.

FortiWeb devices were targeted using CVE-2025-64446, a path traversal vulnerability that can allow an unauthenticated attacker to execute administrative commands via crafted web requests.

Group-IB observed a custom tool attempting to exploit that flaw to create a new administrator account. FortiGate devices are not vulnerable to this FortiWeb-specific issue; against exposed FortiGate systems operators typically tried common username/password combinations.

Fortinet describes CVE-2025-64446 as an improper access control issue affecting FortiWeb. Activity against FortiGate can have consequences beyond the device itself: once operators gain access they may download the device configuration and recover credentials stored inside, including administrator credentials and LDAP/Active Directory account details.

Group-IB says attackers used a known default encryption key to decrypt some stored secrets. Because of this, an exposed configuration should be treated as a potential password disclosure rather than merely a device-management incident.

The campaign also targets Palo Alto Networks GlobalProtect. Group-IB observed attempts to exploit CVE-2026-0257, an authentication-bypass vulnerability in GlobalProtect portals and gateways under particular PAN-OS settings.

The GlobalProtect flaw can allow an unauthorized VPN connection. Palo Alto Networks’ advisory describes the same risk and provides remediation guidance for administrators.

Previous coverage by Cybersecurity News documented exploitation of the FortiWeb flaw and the release of a FortiWeb exploit tool. The current investigation adds evidence that this FortiWeb weakness is being used as part of a wider campaign against network-edge devices.

What happens after access

After gaining initial access, operators often use legitimate administrative and security tools to discover systems, harvest additional credentials and expand their presence within a network.

Group-IB observed tools such as NetExec, Impacket and Mimikatz, along with remote-management platforms like MeshCentral and Atera. The use of legitimate tools can make malicious activity harder to spot when defenders review events individually, since those tools also appear during normal IT operations.

Researchers found 28 active device groups with 84 compromised devices associated with a MeshCentral server during their review. They also observed other remote-access tools and a command-and-control framework.

In some instances data was copied to cloud storage using Rclone. Group-IB noted some victims later appeared on ransomware leak sites, but it has not confirmed a direct affiliation between k0t and the ransomware groups involved.

Organizations can refer to earlier Cybersecurity News coverage about FortiGate configuration theft and GlobalProtect authentication bypass for additional context.

Those reports highlight an important point: stolen credentials obtained from an edge device can enable further access even after the initial vulnerability has been patched.

Security teams should identify whether FortiGate, FortiWeb and GlobalProtect systems are exposed to the internet, ensure devices run patched software, and limit administrative access to trusted networks where possible.

Teams should review logs for unexpected administrator accounts, configuration exports, unusual VPN sessions, repeated login failures and management access from unfamiliar locations.

Palo Alto Networks publishes remediation instructions for CVE-2026-0257; Fortinet’s advisory covers CVE-2025-64446.

If a device may have been accessed, incident responders should investigate connected accounts and systems, rotate credentials stored in or associated with the appliance, and review VPN and identity logs for suspicious follow-on activity.

FortiGate administrators should also verify whether private-data encryption is enabled with an organization-controlled key. The absence of matching indicators does not prove a device or network is safe; defenders should correlate appliance, VPN, identity and endpoint records.

Indicators of compromise (IoCs)

Note: IP addresses and domains above are intentionally defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI feeds with data from 16K SOCs.