OTX Threat: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

Group-IB and NyxLab uncovered a large-scale campaign by threat actor k0t exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials and establish persistent access. The operation involves exploiting CVE-2025-64446 in FortiWeb and CVE-2026-0257 in GlobalProtect, alongside brute-forcing attacks using custom tools. Over 70,000 exposed credentials were discovered, CVEs: CVE-2021-42278, CVE-2021-42287, CVE-2019-6693, CVE-2025-64446, CVE-2026-0257