Group-IB and NyxLab report that a campaign against FortiGate, FortiWeb and Palo Alto GlobalProtect appliances exposed more than 70,000 credentials. A leaked firewall configuration alone carries the keys to the whole network.
A joint investigation published by Group-IB and NyxLab on 21 October 2026 describes a large-scale campaign against the firewalls and VPN appliances at the edge of corporate networks. The operator, tracked under the alias "k0t", exposed more than 70,000 credentials from the devices it reached. Group-IB assesses that the actor is linked to the Qilin and The Gentlemen ransomware groups, most likely as an initial access broker selling ready-made network access to them.
There are three routes in. On FortiWeb appliances, the path traversal flaw CVE-2025-64446 is used to create a local administrator account. On FortiGate devices, weak passwords are brute-forced and captured configuration files are decrypted with the default FortiOS encryption key tracked as CVE-2019-6693. On the Palo Alto side, GlobalProtect is attacked through CVE-2026-0257, an authentication bypass exploited with forged session cookies. A large share of the FortiGate compromises is dated to February–June 2026, meaning many organisations were exposed for months without knowing it.
What makes this different from an ordinary vulnerability story
The important part is not a single flaw but the fact that a firewall configuration is effectively a credential store. When that file leaks, the attacker does not just get the rule set: VPN user lists, LDAP bind accounts, local administrator passwords and site-to-site tunnel keys sit in the same file. That is why Group-IB argues every exposed configuration should be treated as a credential disclosure event.
The second notable detail is how the operator stays in. Rather than installing custom malware, it leans on legitimate remote access tools: AnyDesk, Atera, Teramind, MeshCentral and ngrok. Because many organisations already run one or two of these for support, security software raises no alarm and the activity looks ordinary in the logs.
What this means for Turkish SMEs
In the victim breakdown, Asia Pacific leads with 37.6% of the unique domains identified. Group-IB cautions that this reflects the density of internet-exposed devices rather than deliberate targeting, and that the count is a lower bound. Türkiye is not a separate heading in the report, but the risk profile is identical: an appliance deployed for remote work and branch connectivity, left with its management interface facing the internet and never updated since installation, is the same open door wherever it stands.
Among construction offices, shipping and agency firms, logistics companies, plaza offices and manufacturing sites across Istanbul's Anatolian side, the pattern is consistent: one firewall carries internet access, VPN and branch tunnels at once, with no patching schedule and a configuration backup sitting in an unencrypted folder. Losing that device does not mean losing one box, it means handing over the keys to the whole network.
What we recommend at Kamer Bilişim
- Take the management interface off the internet. Make the administration panel of firewalls and VPN appliances reachable only from the internal network or over a trusted VPN. Where exposure is unavoidable, add source IP restrictions, lengthen lockout periods and investigate repeated lockouts.
- Treat configuration backups as already leaked and rotate the passwords. On FortiGate, enable the "private-data-encryption" setting. Plan a rotation for the VPN users, LDAP bind accounts and local administrator passwords that appear in the configuration, and make multi-factor authentication mandatory on every administrator and VPN account.
- Build an inventory of remote access tools. Write down which remote support tool is officially in use on your network, and treat any AnyDesk, Atera, MeshCentral or ngrok installation outside that list as an alert. That is the most practical way to catch the persistence method in the report.
To have your firewall and VPN setup reviewed against these three points, reach us through our contact page. A short assessment starting with a device inventory, software versions and a list of internet-facing services is what pays off most here.
Source: Group-IB & NyxLab, "Stray Cat, Open Doors: How k0t Wanders Through the Network Edge" (21 October 2026); The Hacker News (23 October 2026)
Source: Group-IB