Fortinet, Palo Alto firewall breach: k0t campaign exposes 70,000 logins

A hacking campaign that broke into internet-facing firewalls and VPN gateways made by Fortinet and Palo Alto Networks has exposed more than 70,000 login credentials and related records, according to a joint investigation by the cyber-security firm Group-IB and the research team NyxLab published on October 21, 2026. The researchers linked the activity to an operator using the name k0t and said the actor appears to sell the access it gains to other criminals. The Fortinet and Palo Alto firewall breach became one of the most searched security topics in the United States on October 23.

Firewalls and VPN gateways are the front door of a company network. They sit on the open internet so that staff can log in from outside, which also makes them easy for attackers to find. When such a device is taken over, the attacker can often reach the systems behind it and collect the passwords of the people who use it. For a business, that means a single unpatched box can turn into a company-wide incident.

The report describes a campaign run at scale rather than aimed at chosen victims. According to Group-IB and NyxLab, k0t appeared to pick targets by scanning for exposed network appliances in bulk, then trying known flaws and weak passwords on whatever answered. Once inside, the researchers said, the attackers used widely available tools, including NetExec, Impacket and Mimikatz, to map networks, collect more credentials and widen their access. That pattern is typical of access brokers, who then pass the foothold to ransomware gangs that encrypt data and demand payment.

The flaws involved are not new. The FortiWeb flaw carries a 2025 identifier and Fortinet has issued fixed releases, and Palo Alto Networks has published guidance for the GlobalProtect issue, which it says affects certain portal and gateway setups where authentication override cookies are enabled with a specific certificate configuration. Many of the compromises, by one account of the report, took place between February and June 2026. The lesson for business owners is that security spending does little when devices are left unpatched or protected by default passwords.

For Indian companies the risk is direct. FortiGate and GlobalProtect devices are widely used by Indian firms, banks, hospitals and government bodies to give staff remote access, and ransomware has hit Indian organisations repeatedly. The report did not publish a country-by-country list of victims, so it is not known how many Indian organisations are among them.

Short-term: Companies running the named devices are being urged by security researchers to apply the vendors' patches for CVE-2025-64446 and CVE-2026-0257, take management screens off the public internet, change every password stored on or linked to the appliances, and check logs for unknown administrator accounts, configuration exports, unusual VPN sessions and repeated failed logins. Fortinet and Palo Alto Networks publish the official remediation steps in their security advisories.

Long-term: The campaign adds to pressure on companies to treat edge devices as critical assets, with regular patching, multi-factor login and monitoring, rather than install-and-forget boxes. It also strengthens the case for "zero trust" designs, in which getting past the firewall does not automatically grant access to everything behind it.

Who is affected: IT and security teams at firms of every size that use FortiGate, FortiWeb or GlobalProtect, employees whose logins may be in the exposed data, managed service providers who look after such devices for clients, and cyber-insurers who price ransomware risk.

Questions and Answers