Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords

Internet-facing firewalls and VPN systems are under attack in a campaign that aims to steal credentials and gain lasting access to corporate networks.

The activity targets FortiGate and FortiWeb devices from Fortinet, as well as Palo Alto Networks GlobalProtect portals. Once inside, operators can collect passwords stored in device configurations and use them to move deeper into a victim’s network.

The campaign is linked to an operator known as k0t. Group-IB and NyxLab say the activity affected organizations across different industries and regions.

Their investigation identified more than 70,000 exposed credentials and related data, including network-device credentials and LDAP records. The researchers warn that this total does not confirm that every listed credential led to a successful compromise.

Analysts from Group-IB, working with NyxLab, identified the campaign and described its methods in a report published on October 21, 2026.

They said operators search for exposed network equipment in bulk, then try to break in by exploiting software flaws or guessing weak passwords. Their findings include stolen credentials, signs of persistent remote access and cases of data theft.

Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems

The operators use public search services to find internet-facing VPN portals and firewalls. They then check discovered systems for weaknesses and attempt to gain access.

Group-IB says the activity is broad rather than focused on a single industry. The number of devices exposed online and their settings may help explain which organizations appear in the collected data.

FortiWeb devices were targeted with CVE-2025-64446, a path traversal flaw that can let an unauthenticated attacker run administrative commands through crafted web requests.

Group-IB observed a custom tool attempting to use the flaw to create a new administrator account. FortiGate devices are not vulnerable to this FortiWeb flaw; instead, operators tried common username and password combinations against exposed FortiGate systems.

Fortinet describes CVE-2025-64446 as an improper access control issue affecting FortiWeb. The FortiGate activity can have effects beyond the firewall itself. After gaining access, operators may download a device configuration file and recover credentials stored in it, including administrator and LDAP or Active Directory account details.

Group-IB says the attackers used a known default encryption key to decrypt some stored secrets. Organizations should therefore treat a potentially exposed configuration as a possible password disclosure, not just as a device-management issue.

The campaign also targets Palo Alto Networks GlobalProtect systems. Group-IB observed attempts to exploit CVE-2026-0257, an authentication bypass flaw in GlobalProtect portals and gateways under specific PAN-OS settings.

The flaw can allow an unauthorized VPN connection. Palo Alto Networks’ advisory describes the same risk and advises administrators to follow its remediation guidance.

Cybersecurity News has previously covered FortiWeb flaw exploitation and a FortiWeb exploit tool release. These reports provide background on the FortiWeb weakness; the current investigation adds evidence of operators using it as part of a wider campaign against network-edge devices.

What happens after access

After entering a network, operators may use legitimate administration and security tools to discover systems, seek additional credentials and expand access.

Group-IB observed tools including NetExec, Impacket and Mimikatz, alongside remote-management software such as MeshCentral and Atera. Their use can be hard to spot when defenders review only one event at a time, since legitimate tools may also appear in normal IT work.

Researchers found 28 active device groups with 84 compromised devices linked to a MeshCentral server during their review. They also saw signs of other remote-access tools and a command-and-control framework.

In some cases, data was copied to cloud storage using Rclone. Group-IB said some victims later appeared on ransomware leak sites, but it has not confirmed that k0t is directly affiliated with the ransomware groups involved.

Organizations can read more about FortiGate configuration theft and GlobalProtect authentication bypass activity in earlier Cybersecurity News coverage.

These related reports describe risks that matter after an edge device is compromised: stolen credentials may enable further access, even if the initial entry point is later patched.

Security teams should check whether FortiGate, FortiWeb and GlobalProtect systems are exposed to the internet, confirm that they run fixed software, and restrict administrative access to trusted networks where possible.

They should review logs for unexpected administrator accounts, configuration exports, unusual VPN sessions, repeated login failures and management access from unfamiliar locations.

Palo Alto Networks’ advisory provides remediation instructions for CVE-2026-0257; Fortinet’s advisory covers CVE-2025-64446.

If a device may have been accessed, teams should investigate connected accounts and systems, rotate credentials stored in or linked to the appliance, and review VPN and identity logs for suspicious follow-on activity.

FortiGate administrators should also check whether private-data encryption is enabled with an organization-controlled key. A lack of matching indicators does not prove that a device or network is safe; defenders should correlate appliance, VPN, identity and endpoint records.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords appeared first on Cyber Security News.