70,000 Firewall and VPN Credentials Just Got Harvested — Here's What That Means If You Run One
By UVIDSTUDIO · October 27, 2026 · 8 min read · Cybersecurity
Researchers say a threat actor tracked as "k0t" pulled more than 70,000 credentials from exposed Fortinet and Palo Alto firewalls and VPN gateways worldwide, mixing known CVEs with brute-force password guessing to resell footholds to ransomware crews. Here's what happened on October 21, 2026, and what to check on your own firewall this week.
A threat-intelligence report published this week found that a group tracked as k0t has harvested more than 70,000 login credentials from exposed Fortinet and Palo Alto Networks firewalls and VPN gateways around the world — not through some exotic zero-day, but through known, already-patched bugs and plain brute-force password guessing left to run against devices sitting open on the internet. If your business runs a FortiGate, FortiWeb, or GlobalProtect appliance for remote access — and a lot of small offices do, because it's the box an IT contractor racked years ago and nobody has logged into since — this is the week to actually check it.
What happened
Researchers at Group-IB and NyxLab published findings on October 21, 2026 describing a large-scale credential-harvesting campaign against internet-facing network edge devices — the firewalls and VPN gateways that sit between a company's internal network and the open internet. The campaign, attributed to a threat actor tracked as k0t (also linked to the aliases CryptoFeel, Member19, and QazWsxShop), pulled more than 70,000 credentials from Fortinet FortiGate and FortiWeb appliances and Palo Alto Networks GlobalProtect gateways, combining exploited vulnerabilities with straightforward brute-forcing against devices reachable from the open internet (The Hacker News).
Two known, already-patched CVEs reportedly did much of the work: CVE-2026-0257, a PAN-OS GlobalProtect authentication-bypass bug now listed on CISA's Known Exploited Vulnerabilities catalog, fixed in PAN-OS 12.1.4-h6/12.1.7 and 11.2.12; and CVE-2025-64446, a critical path-traversal flaw in FortiWeb fixed in versions 7.4.8 and 7.6.6. Once inside, the attackers reportedly kept access open through legitimate-looking channels — OpenConnect VPN sessions and remote-management tools, alongside the AdaptixC2 toolkit — rather than obvious malware, which is part of why the activity went unnoticed for as long as it did (Cyberpress). Researchers believe k0t operates as an initial access broker — a seller of footholds rather than the crew running the ransomware itself — though some victims tied to the harvested credentials have since turned up on the Qilin and The Gentlemen ransomware leak sites.
Why it matters for small businesses
It's tempting to read "70,000 credentials" and assume this is strictly an enterprise problem. It isn't. FortiGate and GlobalProtect are two of the most common firewall and VPN brands small and mid-sized businesses actually buy, precisely because they're affordable, well-reviewed, and easy for a generalist IT contractor to set up once and walk away from. That "set up once and walk away" pattern is exactly the gap this campaign exploited: a firewall doesn't nag you with an update notification the way a laptop does, so a vulnerability the vendor fixed months ago can sit live and exploitable indefinitely on a device nobody checks anymore. And unlike a phishing email that needs someone to click something, exploiting an internet-facing firewall needs no human mistake at all — just a device that's reachable and unpatched, which automated scanners find constantly, around the clock. We've written before about how a cyber footprint audit catches exactly this kind of forgotten, internet-facing device before an attacker does — the firewall protecting your network is itself part of that footprint, not separate from it.
What to do this week
- Find out exactly which firewall or VPN brand and firmware version you're running — ask whoever manages your network (in-house IT, an MSP, or whoever installed it years ago) directly; "I think it's a Fortinet box" isn't an answer you can act on.
- If it's a Fortinet or Palo Alto device, confirm it's on a patched build — FortiWeb 7.4.8 or 7.6.6 or newer for CVE-2025-64446, and PAN-OS 12.1.4-h6, 12.1.7, or 11.2.12 or newer for CVE-2026-0257 — and check the actual version number against the vendor's advisory rather than assuming "it's probably fine."
- Rotate every credential tied to that device, including any Active Directory or LDAP account the firewall uses to authenticate users, since patching the device doesn't un-expose credentials that were harvested before the patch went in.
- Turn on MFA for VPN logins specifically, not just email and your main business apps — multi-factor authentication on the one login that opens a tunnel straight into your internal network is exactly the layer that stops a stolen password from becoming a breach.
- Review who actually has remote-management access to the firewall itself and remove anyone who shouldn't still have it — a former contractor's still-active login is a more common finding than most businesses expect.
- Put this device on the same patching cadence as everything else you maintain — the routine in our patch-management guide applies just as much to network appliances as it does to a website's CMS, and a firewall is the worst possible thing to let go stale.
None of this requires becoming a network engineer overnight — it requires someone actually owning the question of what's running on the edge of your network and whether it's current, which is routinely the piece that falls through the cracks between an IT contractor who set something up once and a business that assumed "set up" meant "done forever." If you're a small business or nonprofit in Jersey City, Hudson County, or anywhere in the NYC metro and you're not sure who's watching your firewall for disclosures exactly like this one, that's precisely the gap our cybersecurity team closes — and if a proper business VPN setup is overdue, our NordLayer guide is a reasonable place to start.