Kiberxavfsizlik tadqiqotchilari Fortinet FortiGate va Palo Alto Networks GlobalProtect fayervollari kabi ochiq tarmoq chekka qurilmalarini nishonga olgan keng ko'lamli kampaniya tafsilotlarini oshkor qildi.
"Ushbu tekshiruvdan olingan artefaktlar shuni ham ko'rsatadiki, ushbu kampaniya operatorlari butun dunyo bo'ylab ko'plab tashkilotlarga kirish huquqiga ega bo'lgan va ba'zi jabrlanuvchilarni yanada chuqurroq buzishga uringan, natijada doimiy masofaviy kirish va ma'lumotlar o'g'irlanishi yuz bergan", — deb ta'kidlanadi Group-IB va NyxLab tomonidan e'lon qilingan qo'shma tekshiruvda.
Keng tarqalgan ekspluatatsiya faoliyati k0t nomi bilan tanilgan tahdid aktoriga bog'langan, u CryptoFeel, Member19 va QazWsxShop taxalluslari bilan ham tanilgan. Ushbu kiberjinoyatchi aktor birinchi marta 2025-yil 22-oktabrda yovvoyi tabiatda kuzatilgan.
Tahdid aktori Qilin va The Gentlemen kabi to'lov dasturi (ransomware) guruhlari bilan aloqador deb baholanadi, ehtimol dastlabki kirish brokeri yoki sherik sifatida faoliyat yuritadi. Tahdid aktorining qorong'u veb (dark web) faoliyatini tahlil qilish shuni ko'rsatadiki, u zaiflik ekspluatatsiya kodlari va vositalarini yoki FOFA va ZoomEye kabi metama'lumot qidiruv dvigatellari uchun premium hisoblarni sotib olishga katta qiziqish bildiradi.
Kampaniya jabrlanuvchilari global bo'lib, keng sohalarni qamrab oladi, chunki ochiq tarmoq qurilmalari tanlanmasdan nishonga olinadi. Komprometatsiyalarning katta qismi 2026-yil fevral va iyun oylari orasida sodir bo'lgan, bu esa FortiBleed kod nomi bilan atalgan boshqa hisob ma'lumotlarini yig'ish kampaniyasi bilan ham mos keladi.
Jabrlanuvchilarning deyarli 38 foizi Osiyo-Tinch okeani mintaqasida, 31,9 foizi Lotin Amerikasida, 15,8 foizi Yevropada va 12,7 foizi Yaqin Sharq va Shimoliy Afrikada joylashgan.
Hujum zanjiri quyidagicha amalga oshiriladi:
- FOFA va ZoomEye kabi ommaviy skanerlash vositalari orqali razvedka o'tkazish, internetga ulangan VPN va fayervoll qurilmalarini aniqlash, nomzodlarni mahsulot bo'yicha filtrlash va potentsial zaif chekka qurilmalarning maqsad ro'yxatlarini tuzish.
- Ushbu qurilmalarni CVE-2025-64446 (FortiWeb'dagi yo'l o'tish zaifligi) va CVE-2026-0257 (Palo Alto Networks PAN-OS va Prisma Access'dagi autentifikatsiyani chetlab o'tish zaifligi) kabi ma'lum zaifliklar orqali "fortnew.py" va "exploit20260257.py" nomli maxsus Python skriptlari yordamida ekspluatatsiya qilishga urinish, yoki keng tarqalgan foydalanuvchi nomi va parol kombinatsiyalari yordamida brut-fors hujumlarini amalga oshirish, natijada dastlabki kirish huquqini qo'lga kiritish.
- OpenConnect VPN ulanishi orqali nishonlarda mustahkam o'rin egallash.
- Post-ekspluatatsiya harakatlari va qo'shimcha hisob ma'lumotlarini o'g'irlash, jumladan Active Directory, SMB va o'rnatilgan antivirus yechimlarini ro'yxatga olish.
- MeshCentral Agent, Atera, Teramind va AnyDes kabi qonuniy masofaviy kirish vositalari, shuningdek AdaptixC2 nomli ochiq manbali, dushman emulyatsiya tizimi yordamida xostda doimiy kirishni ta'minlash.
- Rclone yordamida Wasabi S3 chelaklari va MEGA bulut disklariga yig'ilgan ma'lumotlarni o'g'irlash.
Hujumlar shuningdek NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam va Mimikatz kabi qonuniy administrator va pentest yordamchi dasturlaridan foydalanish bilan ham ajralib turadi, bu esa jabrlanuvchilarning korporativ muhitlariga yanada chuqurroq kirib borishga yordam beradi.
"k0t potentsial nishonlarni alohida tashkilotlarni tadqiq qilish o'rniga, ochiq tarmoq qurilmalarini keng ko'lamda ro'yxatga olish orqali tanlayotganga o'xshaydi", — deb ta'kidlaydi Group-IB va NyxLab tadqiqotchilari. "Uning aytgan geografik ustuvorliklari AQSh va Kanada bilan boshlanadi, so'ngra Yevropa mamlakatlari va tanlangan APAC bozorlari keladi."
"Shuning uchun ochiq qurilmaning mahsuloti va joylashuvi, uni ishlatayotgan tashkilotning sohasidan ko'ra muhimroq ko'rinadi, bu esa ushbu kampaniyada kuzatilgan keng jabrlanuvchilar doirasiga mos keladi."
k0t'ning Qilin va The Gentlemen bilan aloqalari shundan kelib chiqadiki, kampaniyaning ko'plab jabrlanuvchilari keyinchalik to'lov dasturi guruhlari tomonidan ularning ma'lumotlar sizdirish saytlarida ro'yxatga olingan. Biroq, tahdid va ushbu to'dalar o'rtasidagi aniq aloqa tabiati noaniq qolmoqda.
Bundan tashqari, Group-IB va NyxLab ushbu faoliyat va FortBleed o'rtasida "juda kam ustma-ust tushish" (negligible overlap) topganini aytishdi. Kampaniya bilan bog'liq holda tarmoq qurilmalari va LDAP to'plamlari bilan bog'liq 70 000 dan ortiq ochiq hisob ma'lumotlari aniqlangan.
"Bu ko'plab operatorlar FortiBleed faoliyat klasteriga jalb qilinganligi haqidagi xabarlarga mos keladi, bu esa bu alohida ma'lumotlar to'plami, operatorlar kichik to'plami yoki kengroq FortiBleed bilan bog'liq faoliyat doirasidagi aloqador kirish operatsiyasi bo'lishi mumkinligini ko'rsatadi", — deb ta'kidlaydi tadqiqotchilar. "Tashkilotlarga ushbu hisobotda tilga olingan har qanday zaifliklar tegishli tarzda bartaraf etilishini ta'minlash tavsiya etiladi."
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration," according to a joint investigation published by Group-IB and NyxLab.
The widespread exploitation activity has been attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop. The cybercriminal actor was first seen in the wild on October 22, 2025.
The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate. Analysis of the threat actor's dark web activity reveals a keen interest in purchasing vulnerability exploit code and tools or premium accounts for metadata search engines like FOFA and ZoomEye.
The campaign's victims are global and belong to a broad range of sectors, given the indiscriminate targeting of exposed network devices. A significant chunk of compromises are said to have taken place between February and June 2026, which also overlaps with another credential harvesting campaign codenamed FortiBleed.
Nearly 38% of victims are concentrated in the Asia Pacific region, followed by 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa.
The attack chain plays out as follows -
- Conduct reconnaissance through public scanning tools like FOFA and ZoomEye to enumerate internet-facing VPN and firewall appliances, filter candidates by product, and put together target lists of potentially vulnerable edge devices.
- Attempt to exploit these devices via known vulnerabilities like CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit20260257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.
- Establish a foothold on the targets via an OpenConnect VPN connection.
- Conduct post-exploitation actions and additional credential theft like enumeration of Active Directory, SMB, and installed antivirus solution.
- Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2.
- Exfiltrate harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.
The attacks are also characterized by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims' corporate environments.
"k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations," Group-IB and NyxLab researchers said. "His stated geographic priorities begin with the United States and Canada, followed by European countries and selected APAC markets."
"The product and location of an exposed device therefore appear to matter more than the industry of the organization operating it, consistent with the broad range of victims observed in this campaign."
k0t's links to Qilin and The Gentlemen stem from the fact that many victims of the campaign were also later listed by the ransomware groups on their data leak sites. However, the exact nature of the connection between the threat and these gangs is unclear.
What's more, Group-IB and NyxLab said they found a "negligible overlap" in compromised data between this activity and FortBleed. More than 70,000 exposed credentials associated with network devices and LDAP dumps have been identified in connection with the campaign.
"This aligns with reports that many operators are likely to be involved in the FortiBleed activity cluster, suggesting that this may be a separate dataset, operator subset, or related access operation within the broader FortiBleed-related activity," the researchers said. "Organizations are advised to act on ensuring that any vulnerabilities mentioned in this report are appropriately remedied."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.