Group-IB and NyxLab say the Fortinet Palo Alto firewall breach tied to k0t ran through FortiGate, FortiWeb, and Palo Alto GlobalProtect. The activity let operators harvest credentials, keep access open, and pull data out of targeted networks.
FortiGate and Palo Alto GlobalProtect
The investigation says many of the FortiGate compromises were dated between February 2026 and June. That timeline points to a campaign that stayed active long enough to move from access into credential theft and persistence, not a one-off intrusion.
Artifacts from the investigation showed access to numerous organizations worldwide. Some victims were then further targeted for compromise, which suggests the operators used stolen credentials as a launch point rather than stopping at the first foothold.
Group-IB and NyxLab
Group-IB also said the investigation uncovered adversarial tooling and TTPs used by k0t. For defenders, that is the part to map first: the tools and tradecraft can be matched against logs from FortiGate, FortiWeb, and Palo Alto GlobalProtect before the same access pattern is reused elsewhere.
The case may also connect to the FortiBleed cluster seen earlier in June. Group-IB said it saw victim overlap with Qilin and The Gentlemen, but any direct affiliation with those ransomware groups is still unconfirmed, so the overlap reads more like a comparison set than a settled link.
The next step is the additional technical report Group-IB said it will publish later. Until then, the immediate action for defenders is to review exposed edge devices for credential theft, persistent remote access, and any signs of data exfiltration tied to the same pattern.
