kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

k0t

also tracked as cryptofeel 1, member19 1, qazwsxshop 1

1 story · 1 in the wild · October 26, 2026 – October 26, 2026

evidence: 1 observed

how they got in

  • exposed service 1 · Oct 26

sectors

  • critical infrastructure 1 · Oct 26
  • defense 1 · Oct 26
  • finance 1 · Oct 26
  • government 1 · Oct 26

techniques

  • credential access 1 · Oct 26
  • exploitation 1 · Oct 26

attack phases seen

  • Credential access 1 · Oct 26
  • Initial access 1 · Oct 26

what we reported, newest first, grouped by story

Oct 23 – October 26, 2026

  • A campaign against exposed firewalls and VPNs yielded more than 70,000 credentials. A joint investigation attributed the activity to k0t, also known as CryptoFeel, Member19 and QazWsxShop. Operators scanned for FortiGate and GlobalProtect infrastructure, exploited CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS/Prisma Access or used password attacks, then enumerated Active Directory, SMB and antivirus products. Researchers assess k0t as a likely initial-access broker or affiliate with links to Qilin and The Gentlemen (The Hacker News). · Oct 26 · observed · via exposed service · as cryptofeel, member19, qazwsxshop · Threat Activity