k0t campaign exposes 70,000 credentials and possible ransomware access pipeline

Group-IB and NyxLab discovered more than 70,000 network credentials linked to a campaign by cyber threat group k0t. However, the hackers did not only steal account credentials. They also created backdoors to corporate networks, which gives ransomware groups new opportunities to infiltrate company systems.

Credentials were only the entry point

The researchers discovered some of the methods used by the attackers, such as the abuse of passwords on FortiGate devices, the exploitation of CVE-2025-64446 vulnerability affecting FortiWeb, and the use of CVE-2026-0257 against vulnerable Palo Alto GlobalProtect gateways. These devices act as shields for corporate networks and grant access to them remotely, which makes them desirable targets for those wanting to break into company systems.

The stolen data included LDAP directory dumps. After getting into the system, the attackers used OpenConnect VPN connections, remote management applications, and AdaptixC2 to maintain access. Some victims were subjected to data theft as well. Many FortiGate compromise cases occurred between February and June 2026.

Afterwards, a number of victims appeared on the leak pages belonging to the ransomware groups known as Qilin and The Gentlemen. This suggests that k0t might be profiting from access to compromised networks, but the researchers are yet to verify this connection.

In addition, the campaign has been successful across Asia-Pacific where 37.6% of all the unique domains observed originate from. Despite that, the researchers stressed that this might just indicate the number of devices that were active in Asia, and not necessarily that there was a special focus on Asian targets.

FortiBleed is a separate, still-active problem

On October 6, 2026, an advisory issued by the FBI and the Secret Service cautioned that FortiBleed still poses a threat to the FortiGate firewalls and the SSL VPN gateways. The attackers used the credentials they managed to secure earlier, leveraged GPU-based systems to decode password hashes, and created new admin accounts. They sometimes managed to lock their victims out of their own devices.

FortiBleed has spread worldwide. SOCRadar verified more than 86,644 compromised devices across 194 countries. Fortinet said attackers reused stolen login credentials and tried to guess passwords. The campaign did not involve a newly disclosed Fortinet vulnerability.

Although Group-IB found little overlap between FortiBleed and k0t’s stolen data, it has not ruled out a connection between the operations. So far, there is no evidence to suggest that the same attackers were behind both incidents. The figures also represent different things: k0t’s 70,000 credentials as opposed to FortiBleed’s 86,644 devices. Combining these figures would distort the full scale of the events.

From initial access to ransomware in 22 seconds

Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation accounted for 31% of breaches, overtaking stolen credentials as the leading entry method. Yet only 26% of critical, known-exploited vulnerabilities were fully remediated, with the median time to fix them reaching 43 days.

That delay is particularly concerning because attackers can exploit vulnerabilities before patches become available. Mandiant’s M-Trends 2026 estimated a minus-seven-day mean time to exploit, indicating that attacks often began before fixes were released. Network devices such as VPN gateways and routers are particularly difficult to monitor because they often lack standard endpoint security tools.

Once attackers gain access, the threat can escalate quickly. Mandiant found that the median time between an initial breach and the hand-off to another criminal group fell from more than eight hours in 2022 to just 22 seconds in 2025.

The threat is already evident. In an October 19 update, Unit 42 reported attempted exploitation of CVE-2026-0257 by Qilin and Inc ransomware operators. It also noted separate reports involving Settra. However, its earlier investigation found no evidence that attackers had moved deeper into affected networks.

What it means for finance and crypto infrastructure

IBM found that 62% of reported AI-driven attacks targeted critical infrastructure. Financial-services breaches averaged $6.3 million. The IMF also warned in October that cyber threats could become systemic as financial networks grow more interconnected. Crypto firms face similar risks from compromised access. Cryptopolitan reported roughly $2 million in losses involving Fetch.ai and NuNet in September 2026. Those incidents involved compromised signing credentials, not VPN access, and have no established connection to k0t.

The smartest crypto minds already read our newsletter. Want in? Join them.