k0t

crimewarevia MISP

5 CVEs attributed

Aliases3

CryptoFeelMember19QazWsxShop

k0t (also CryptoFeel, Member19, QazWsxShop) is a financially motivated cybercriminal actor, first seen on 22 October 2025, behind a large-scale campaign against exposed network edge devices, according to a joint investigation by Group-IB and NyxLab published in October 2026. The actor finds targets by mass enumeration with FOFA and ZoomEye rather than by researching specific organizations. It gains access by exploiting known flaws such as CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PAN-OS/Prisma Access) with custom Python scripts, or by brute-forcing Fortinet FortiGate and Palo Alto GlobalProtect appliances, then connects over OpenConnect VPN. Post-exploitation relies on NetExec, Impacket, noPac, Kerbrute, PetitPotam and Mimikatz, persistence on MeshCentral, Atera, Teramind, AnyDesk and AdaptixC2, and exfiltration on Rclone to Wasabi S3 and MEGA. More than 70,000 exposed credentials are linked to the campaign, with victims mostly in Asia Pacific and Latin America; the actor states that the US and Canada are its priority. Many victims were later listed by the Qilin and The Gentlemen ransomware groups, so k0t is assessed to be an initial access broker or affiliate, but the exact relationship is unclear. The activity partially overlaps in time with the FortiBleed credential-harvesting cluster, with negligible overlap in compromised data.

Attributed CVEs5

CVE	Description	Severity	EPSS	Flags	Modified
CVE-2026-0257	Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.	CRITICAL9.1	96%p100	KEV+RPoC	2026-10-26
CVE-2026-0257	Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.	CRITICAL9.1	96%p100	KEV+RPoC	2026-10-26
CVE-2025-64446	A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.	CRITICAL9.4	91%p100	KEVWeaponized	2026-10-18
CVE-2025-64446	A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.	CRITICAL9.4	91%p100	KEVWeaponized	2026-10-18
CVE-2019-6693	Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).	MEDIUM6.5	6.64%p94	KEV+RPoC	2026-08-04