Post

group-ib and nyxlab have detailed k0t, an initial access broker also tracked as cryptofeel, member19, and qazwsxshop, harvesting credentials from enterprise edge devices. more than 70,000 valid usernames and passwords from network gear and ldap dumps have been exposed in the campaign.

jark after dark

@jarkafterdark.com

the targets are fortinet fortigate and fortiweb, and palo alto globalprotect, pan-os, and prisma access. k0t finds them at scale, using fofa and zoomeye to fingerprint exposed devices. thehackernews.com/2026/10/hack...

thehackernews.comHackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 CredentialsA campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

jark after dark

@jarkafterdark.com

initial access comes through CVE-2025-64446, a fortiweb path traversal, and CVE-2026-0257, the pan-os and prisma access authentication bypass, or plain brute-forcing of common credentials.

jark after dark

@jarkafterdark.com

persistence runs on remote access tools and the adaptixc2 framework. data is exfiltrated with rclone straight to wasabi s3 and mega.

27/10/26, 2:37 am0 reposts0 likes

jark after dark

@jarkafterdark.com

group-ib assesses k0t as an access broker tied to the qilin and the gentlemen ransomware operations, though the exact nature of that link is not yet established.

jark after dark

@jarkafterdark.com

this is why it is so important to fully understand the ecrime ecosystem. what you see here is just the supply side component of a ransomware operation. the layer selling the way in, because affiliates love easy access rather than having to pop exploits themselves.