What Happened
The Hacker News reports Group-IB and NyxLab tied a large credential theft campaign to a threat actor called k0t. The actor goes by CryptoFeel and Member19 as well. Researchers link it to the Qilin and The Gentlemen ransomware groups, which points to an initial access broker role.
The actor used FOFA and ZoomEye to find exposed Fortinet FortiGate and FortiWeb devices and Palo Alto Networks GlobalProtect, PAN-OS, and Prisma Access gateways. It exploited CVE-2025-64446 and CVE-2026-0257 or brute-forced logins. After entry, it installed AdaptixC2 and remote access tools, then moved data out with Rclone to Wasabi and MEGA. Researchers counted more than 70,000 exposed credentials. Most compromises took place between February and June 2026.
Why This Matters for Canadian Organizations
The actor’s stated priorities begin with “the United States and Canada.” Canadian banks, hospitals, municipalities, and utilities all run these vendors at the network edge. An edge device compromise gives an attacker a trusted foothold inside your perimeter and a sale-ready access listing for ransomware crews.
Stolen credentials stay useful long after you patch. A device fixed in July still lets an attacker in if the passwords taken in March remain valid. Federally regulated institutions face OSFI Guideline B-13 expectations for technology and cyber risk, and a confirmed breach of personal information triggers a PIPEDA assessment.
What to Do
Patch every Fortinet and Palo Alto device against the two cited CVEs. Rotate all local, VPN, and service account credentials stored on these appliances, even if you believe the patch landed in time. Require phishing-resistant multi-factor authentication on every remote access path.
Audit the logs for new administrator accounts, unfamiliar remote access tools, and unexpected OpenConnect sessions. Watch egress traffic for Rclone, Wasabi, and MEGA. Report suspected compromise to the Canadian Centre for Cyber Security. See more in our Trends archive.
