October 26, 2026
- A campaign against exposed firewalls and VPNs yielded more than 70,000 credentials. A joint investigation attributed the activity to k0t, also known as CryptoFeel, Member19 and QazWsxShop. Operators scanned for FortiGate and GlobalProtect infrastructure, exploited CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS/Prisma Access or used password attacks, then enumerated Active Directory, SMB and antivirus products. Researchers assess k0t as a likely initial-access broker or affiliate with links to Qilin and The Gentlemen (The Hacker News). · Threat Activity