CVE-2025-64446FortiWeb initial-access path
Campaign tooling exploits FortiWeb, not FortiGate, through this vulnerability.
k0t edge-device campaign exposed over 70,000 credentials and established persistent network access
Group-IB and NyxLab report a distinct credential dataset and observed intrusions involving exposed FortiGate, FortiWeb and GlobalProtect devices. Over 70,000 credentials are not a count of victims; ransomware affiliations remain unconfirmed.
- Disclosed
- Oct 21, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- 2 CVEs tracked here
- Splash zone
- FortiGate weak passwords; vulnerable FortiWeb; GlobalProtect override cookies with a reused portal/gateway certificate
- Fortinet · GlobalProtect · credentials
- In the wild
- Yes
- Group-IB and NyxLab observed persistent access and data exfiltration
What happened
The researchers found negligible overlap with the earlier FortiBleed credential dataset. Links to FortiBleed and ransomware groups remain assessments, not proven common operators. Exact victim attribution is incomplete. This report documents newly disclosed campaign evidence rather than a new vulnerability.
For GlobalProtect, check Network → GlobalProtect → Portals/Gateways → Agent authentication settings. Disable authentication override or generate a new dedicated cookie certificate; do not reuse a portal/gateway certificate. Upgrade every portal and gateway using the vendor’s version-specific table.
What’s in the bowl
CVE-2026-0257GlobalProtect authentication-bypass path
Requires authentication override cookies and vulnerable certificate configuration; the campaign forged cookies using the portal certificate.
Crime-scene timeline
Oct 21, 2026
Group-IB and NyxLab publish their joint investigation
Feb–Jun 2026 (approximate)
Many observed FortiGate compromises date to this period
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Group-IB and NyxLab joint investigationPrimaryObserved exploitation, distinct credential dataset, persistence, exfiltration and defensive indicators
- The Hacker NewsReports the campaign on October 23; original research was published October 21
- Palo Alto Networks CVE-2026-0257 advisoryPrimaryRequired configuration and mitigations: dedicated cookie certificate or disable authentication override