Cyberattack campaign k0t targets enterprise firewalls and VPNs

A large-scale cyberattack campaign, identified as ‘k0t’, has targeted enterprise firewalls and VPN installations globally. According to a joint analysis by Group-IB and NyxLab, the campaign focuses on publicly accessible edge devices, specifically targeting Fortinet FortiGate and Palo Alto Networks GlobalProtect systems.

The attackers utilize a combination of exploits and brute-force attacks to gain access. The investigation has linked the campaign to the theft of over 70,000 credentials and various LDAP dumps. Rather than targeting specific companies individually, the actor appears to engage in systematic scanning to exploit reachable vulnerabilities and establish long-term access through persistence and remote-access tools.