Group-IB and NyxLab describe a broad campaign by an actor tracked as k0t. It pulls bulk target lists of exposed VPN and firewall appliances from FOFA and ZoomEye, then tries CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (GlobalProtect auth bypass) or brute-forces FortiGate logins. Group-IB recovered more than 70,000 exposed credentials and records (device, LDAP and AD), which is not a count of confirmed compromises. Some victims later showed up on Qilin and The Gentlemen leak sites, but Group-IB has not confirmed an affiliation.

• Access: OpenConnect VPN sessions using harvested credentials, then AD, SMB and antivirus enumeration with NetExec, Impacket, Mimikatz and Kerbrute.
• Persistence: MeshAgent to MeshCentral servers, plus Atera, AnyDesk and the open-source AdaptixC2 framework.
• Exfiltration: Rclone to Wasabi S3 and MEGA.
• Network IOCs from the report: MeshCentral mesh[.]buttruyen[.]com (62.60.131.43) and meshcentral[.]girydsfsggvb[.]com (62.60.135.64); AdaptixC2 servers 64.94.85.14 and 168.100.11.99; payload hosts 193.149.187.81 and 162.33.178.213, plus sthyjk[.]com; staging servers 162.33.179.249, 193.24.123.162 and 193.149.176.50; Nezha dashboard radesashar[.]com; possible scanner 193.169.194.21. The report also lists file hashes.

Hunt for: VPN logins from unfamiliar OpenConnect clients, new local admin accounts on FortiWeb, exported FortiGate configs, LDAP bind accounts used from VPN pools, and new MeshAgent, Atera or AnyDesk installs on servers. Group-IB notes that an IOC miss doesn't rule out compromise.