Search — “k0t”

Group-IB and NyxLab attribute a large campaign to the actor k0t, who reportedly scans for exposed Fortinet FortiGate and Palo Alto GlobalProtect devices, exploits CVE-2025-64446 and CVE-2026-0257 or brute-forces credentials, and establishes an OpenConnect VPN foothold. Sources describe persistence via MeshCentral, Atera, Teramind, AnyDesk-like tools and AdaptixC2, Rclone exfiltration to Wasabi and MEGA, and AD enumeration with Impacket and Mimikatz. Hunters should look for OpenConnect sessions from edge devices, unexpected RMM agents, and Rclone or AdaptixC2 activity; the sources say more than 70,000 credentials were identified, and the actor is assessed as a possible access broker for Qilin and The Gentlemen.