Group-IB and NyxLab tie edge-device campaign to actor k0t

Past-week coverage · Original source published 2026-10-21.

Group-IB and NyxLab published a joint investigation into a large-scale campaign they attribute to a threat actor tracked as k0t, describing exploitation and brute-forcing of internet-facing network edge devices to harvest credentials and gain persistent access.

The researchers say the operators used attack-surface search engines such as FOFA and ZoomEye to enumerate exposed VPN and firewall appliances in bulk, then tried to exploit vulnerabilities or guess credentials. Most targeted devices were Fortinet firewalls and Palo Alto GlobalProtect portals, according to the write-up. After access, the operators moved to hands-on-keyboard activity, further credential theft and attempts to reach domain administrator control, keeping a foothold through OpenConnect VPN, MeshAgent deployments and RMM tools such as Atera.

The report says victims span many regions and industries, with Asia Pacific and Latin America holding the largest share of unique domains in the dataset. The authors caution that this likely reflects where exposed devices are found rather than deliberate regional targeting. They also note overlaps with the earlier FortiBleed cluster and with victims listed by ransomware groups including Qilin and The Gentlemen, but say any relationship with those groups remains unconfirmed.

Defenders should treat exposed edge appliances as a priority: inventory them, review exposure and authentication settings, and watch for unexpected VPN or remote-management agents.