Ethical Hacking News
Over 70,000 credentials have been exposed due to a large-scale campaign of attacks by the k0t group, highlighting the need for organizations to enhance their cybersecurity posture and prioritize vulnerability remediation.
Over 70,000 credentials were exposed in a large-scale campaign of attacks by the k0t group, leaving numerous organizations worldwide vulnerable to attack. The k0t group, a threat actor linked to ransomware groups, breached enterprise firewalls and VPNs using a series of steps, including reconnaissance and exploitation of known vulnerabilities. The group's ultimate goal is to exfiltrate harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives. The attacks targeted exposed network devices, with a significant chunk of compromises taking place in the Asia Pacific region, followed by Latin America, Europe, and the Middle East and North Africa. Organizations are advised to prioritize their cybersecurity posture and remediate any vulnerabilities mentioned in the report to prevent similar breaches.
The cybersecurity landscape has been dealt another significant blow as a large-scale campaign of attacks has exposed over 70,000 credentials, revealing a concerted effort by a group of hackers known as k0t, who have managed to breach enterprise firewalls and VPNs, leaving numerous organizations worldwide vulnerable to attack. The campaign, which began in October 2025, has been ongoing, with the majority of the breaches taking place between February and June 2026, coinciding with another credential harvesting campaign codenamed FortiBleed.
At the forefront of this campaign is the k0t group, a threat actor assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate. The group's dark web activity has been found to include a keen interest in purchasing vulnerability exploit code and tools or premium accounts for metadata search engines like FOFA and ZoomEye.
The attack chain played out by the k0t group involves a series of steps, starting with reconnaissance through public scanning tools like FOFA and ZoomEye to enumerate internet-facing VPN and firewall appliances, filter candidates by product, and put together target lists of potentially vulnerable edge devices. The group then attempts to exploit these devices via known vulnerabilities like CVE-2025-64446 and CVE-2026-0257, using bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations to obtain initial access.
Once access is gained, the group establishes a foothold on the targets via an OpenConnect VPN connection and conducts post-exploitation actions, including enumeration of Active Directory, SMB, and installed antivirus solutions. The group also establishes persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2.
The attacks are also characterized by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims' corporate environments. The group's ultimate goal appears to be exfiltrating harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.
A significant chunk of the compromises are said to have taken place in the Asia Pacific region, followed by 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa. The attack chain plays out with a "negligible overlap" in compromised data between this activity and FortBleed, suggesting that the two campaigns may be related, but with the exact nature of the connection between the threat and these gangs being unclear.
The group's links to ransomware groups such as Qilin and The Gentlemen stem from the fact that many victims of the campaign were also later listed by the ransomware groups on their data leak sites. However, the exact nature of the connection between the threat and these gangs is unclear.
Organizations are advised to act on ensuring that any vulnerabilities mentioned in this report are appropriately remedied, as the product and location of an exposed device appear to matter more than the industry of the organization operating it. With the campaign's victims belonging to a broad range of sectors, the indiscriminate targeting of exposed network devices has highlighted the need for enhanced security measures to prevent such attacks in the future.
In conclusion, the exposure of 70,000 credentials highlights the need for organizations to prioritize their cybersecurity posture, particularly in light of the rising threat landscape. As the threat actor k0t continues to evolve, it is essential that organizations stay vigilant and take proactive steps to prevent similar breaches in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposure-of-70000-Credentials-The-Scope-and-Impact-of-the-k0t-Cyber-Attack-Campaign-ehn.shtml
https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
https://nvd.nist.gov/vuln/detail/CVE-2025-64446
https://www.cvedetails.com/cve/CVE-2025-64446/
https://nvd.nist.gov/vuln/detail/CVE-2026-0257
https://www.cvedetails.com/cve/CVE-2026-0257/
Published: Fri Oct 23 10:45:09 2026 by llama3.2 3B Q4_K_M
