FortiWeb and FortiGate flaws enable k0t operator to steal 70,000 credentials via path traversal and brute force
Operators known as k0t are harvesting credentials from exposed firewalls and VPN portals using path traversal flaws and password guessing techniques.
Key points
- The campaign targets FortiGate, FortiWeb, and Palo Alto GlobalProtect systems to steal stored configuration credentials.
- Researchers identified over 70,000 exposed credentials linked to the operator known as k0t.
- Attackers exploit CVE-2025-64446 on FortiWeb devices and use brute-force attacks against FortiGate APIs.
An operator known as k0t is conducting a widespread campaign to steal credentials from internet-facing network security appliances. According to Cyber Security News, the activity targets Fortinet FortiGate and FortiWeb devices, as well as Palo Alto Networks GlobalProtect portals. The goal is to harvest passwords stored in device configurations to gain lasting access to corporate networks. Group-IB and NyxLab researchers published their findings on October 21, 2026.
Root cause
The campaign relies on exploiting specific software flaws and weak authentication practices. FortiWeb devices are vulnerable to CVE-2025-64446, which Fortinet describes as an improper access control issue. This flaw allows unauthenticated attackers to execute administrative commands through crafted web requests. FortiGate devices are not affected by this specific FortiWeb vulnerability. Instead, attackers target FortiGate systems by guessing common username and password combinations.
Attack path
Operators build target lists using public search services like FOFA and ZoomEye, as reported by GBHackers. They prioritize exposed VPN and firewall infrastructure rather than specific industries. A custom Python utility attempts to exploit CVE-2025-64446 against FortiWeb devices to create new administrator accounts. For FortiGate appliances, the tool performs credential brute-forcing against the REST API. It includes logic to pause blocked targets for sixty seconds before retrying.
Affected versions
The source material does not specify exact version numbers for the affected FortiGate, FortiWeb, or Palo Alto GlobalProtect systems. It notes that FortiWeb devices are vulnerable to CVE-2025-64446, while FortiGate devices are not susceptible to this specific flaw. The campaign affects organizations across different industries and regions, with Asia Pacific and Latin America showing the largest shares of identifiable victim domains.
Mitigation
- Monitor for unauthorized administrator account creation on FortiWeb devices.
- Enforce strong, unique passwords on FortiGate REST APIs to prevent brute-force success.
- Restrict internet exposure of VPN portals and firewall management interfaces.
- Audit configuration files for stored credentials that could aid lateral movement.
Signals worth monitoring
Teams should watch for sudden spikes in failed login attempts against firewall management interfaces, particularly those followed by successful authentications. Investigate any new administrator accounts created on web application firewalls, especially if they lack expected access controls. Look for unusual data exfiltration patterns, such as large configuration file downloads or LDAP queries from perimeter devices. Check for open VPN sessions that do not match known user activity or scheduled maintenance windows.
What to do and how to stay safe: Fortinet
- Review internet-facing firewall and VPN portal logs for signs of brute-force attacks or unauthorized administrative access.
- Ensure that management interfaces for network security appliances are not directly accessible from the public internet without additional authentication layers.
- Verify that all stored credentials in device configurations are rotated and that default keys are not in use.
- Monitor internal network activity for lateral movement attempts using credentials harvested from perimeter devices.
Step-by-step guide: Phishing Email Examples: How to Spot the Hidden Traps
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch for the FortiWeb vulnerability used in this campaign?
The source material does not state whether a patch or fix has been released for CVE-2025-64446.
Which threat groups are behind this credential theft campaign?
The activity is linked to an operator known as k0t, according to Group-IB and NyxLab.
How many credentials were exposed in this campaign?
Researchers identified more than 70,000 exposed credentials, though this does not confirm every credential led to a compromise.
