FortiGate, FortiWeb va Palo Alto GlobalProtect qurilmalariga qaratilgan keng ko'lamli kampaniya ma'lumotlarni o'g'irlash, doimiy kirish o'rnatish va korporativ ma'lumotlarni tashqariga chiqarish maqsadida amalga oshirilmoqda.
Tadqiqot ushbu faoliyatni k0t nomi bilan tanilgan operator bilan bog'laydi va tarmoq qurilmalari yozuvlari, LDAP to'plamlari va boshqa operatsion artefaktlar orasida 70 000 dan ortiq ochiq ma'lumotlar aniqlanganini ko'rsatadi.
Tadqiqotchilar iyun oyida e'lon qilingan FortiBleed klasteri bilan mumkin bo'lgan bog'lanishlarni aniqladilar, ko'plab FortiGate buzilishlari 2026-yil fevral va iyun oylari orasida sodir bo'lgan.
Biroq, yangi aniqlangan ma'lumotlar to'plami avval kuzatilgan aktyorlar, jumladan FortiBleed bilan bog'lanmagan.
Qilin va The Gentlemen bilan jabrlanuvchilarning mos kelishi mumkin bo'lgan dastlabki kirish brokerligini ko'rsatadi, ammo to'g'ridan-to'g'ri ransomware bilan bog'lanish tasdiqlanmagan.
Operatorlar maqsad ro'yxatlarini FOFA, ZoomEye va mahsulot-filtrlangan qurilma manzillarini taqdim etadigan yer osti xizmatlari yordamida tuzadilar.
Ularning razvedkasi aniq sohalar emas, balki ochiq VPN va xavfsizlik devori infratuzilmasiga ustuvorlik beradi.
Osiyo-Tinch okeani va Lotin Amerikasi aniqlanadigan jabrlanuvchi domenlarining eng katta ulushlarini tashkil qiladi, garchi tadqiqotchilar bu taqsimotni ataylab mintaqaviy maqsad emas, balki ochiqlik naqshlari tushuntirishi mumkinligini ogohlantiradilar.
Kampaniya operatorlari tomonidan kuzatilgan umumiy hujum zanjiri (Manba: GroupIB).
"FortiGate Security Scanner" nomli maxsus Python yordamchi dasturi maqsad ro'yxatlarini bir vaqtda qayta ishlaydi va FortiWeb'ga qarshi CVE-2025-64446 ekspluatatsiyasini sinab ko'radi.
Fortinet ushbu zaiflikni nisbiy yo'l o'tish sifatida tavsiflaydi, bu esa maxsus HTTP yoki HTTPS so'rovlari orqali autentifikatsiyasiz ma'muriy buyruq bajarilishiga imkon beradi.
GroupIB tadqiqotiga ko'ra, skaner cheklovsiz ishonchli xost kirishi bilan administrator hisobini yaratadi, so'ngra ma'lumotlarni tekshiradi.
FortiGate qurilmalari ushbu FortiWeb zaifligiga zaif emas; buning o'rniga, vosita ularning REST API'siga qarshi ma'lumotlar kuch bilan sinab ko'radi.
Uning blokirovka bilan ishlash mantig'i bloklangan maqsadlarni 60 soniya to'xtatib, keyin qayta urinadi. Muvaffaqiyatli autentifikatsiyadan so'ng, ixtiyoriy konfiguratsiya tahlil qilish funksiyasi qurilma sozlamalarini yuklab oladi va CVE-2019-6693 bilan bog'liq ma'lum standart FortiOS AES kaliti yordamida saqlangan sirlarni shifrdan chiqaradi.
k0t FOFA'dan premium hisob yoki FOFA, ZoomEye va Censys'dan talab bo'yicha IP eksportlarini so'raydi (Manba: GroupIB).
Qayta tiklangan materiallar LDAP bog'lanish ma'lumotlarini o'z ichiga olishi mumkin, bu esa perimetr buzilishidan Active Directory'ga yo'l ochadi.
GlobalProtect uchun operatorlar autentifikatsiya bekor qilish cookie soxtalashtirish orqali CVE-2026-0257 ekspluatatsiya qiladigan alohida skanerdan foydalanadilar.
Ushbu zaiflik ta'sirlangan konfiguratsiyalarda ruxsatsiz VPN ulanishlariga ruxsat beradi, bu autentifikatsiya bekor qilish va sertifikat qayta ishlatish shartlarini talab qiladi.
Vosita keyinchalik tarmoq kirishini o'rnatish uchun OpenConnect'ni chaqiradi.
Ichkariga kirgach, operatorlar NetExec, Impacket, Kerbrute va Mimikatz yordamida qo'lda klaviatura orqali kashfiyot va ma'lumot o'g'irlashni amalga oshiradilar.
Kuzatilgan faoliyat Windows sirlarini chiqarish, Kerberos xizmat hisoblari xeshlarini yig'ish va noPac hamda sertifikat bilan bog'liq hujum zanjirlari orqali domen administrator huquqlarini qo'lga kiritishni o'z ichiga oladi.
Doimiy kirish VPN kirishidan tashqariga chiqadi. Tadqiqotchilar mesh[.]buttruyen[.]com'dagi MeshCentral infratuzilmasini aniqladilar, bu 28 ta faol qurilma guruhidagi 84 ta buzilgan oxirgi nuqtani boshqaradi.
Yana 100 ta guruh o'chirilgan, bu esa ushbu tarixiy yozuvlarning ishonchli joriy jabrlanuvchi sonini o'rnatishiga to'sqinlik qiladi.
MeshAgent'lar agent[.]afahimsa[.]top orqali tarqatilgan, bu esa yuklash xostini boshqaruv serveridan ajratadi.
Rclone ma'lumotlarni tashqariga chiqarish uchun ishlatilgan, AdaptixC2 esa suiiste'mol qilingan tijorat masofaviy boshqaruv vositalari bilan birga qo'shimcha buyruq va nazorat kanalini taqdim etgan.
Bir nechta operator hisoblari va taxalluslari hamkorlik operatsiyasini ko'rsatadi, bu kirishni buzg'unchilar orasida taqsimlash yoki uni sotuvga tayyorlashni anglatishi mumkin.
Group-IB'ning alohida tadqiqoti Qilin'ning sheriklik modelini va The Gentlemen'ning buzilgan Fortinet infratuzilmasiga tayanishini hujjatlashtiradi, bu esa kuzatilgan mos kelishlarni bog'lanishsiz tegishli qiladi.
Himoyachilar tuzatishni zaiflikni boshqarish va kirish javobi sifatida ko'rishlari kerak.
Sotuvchi tuzatishlarini qo'llang, kutilmagan administrator hisoblarini tekshiring, ruxsatsiz VPN sessiyalari va masofaviy boshqaruv agentlarini tekshiring, hamda ochiq katalog ma'lumotlarini aylantiring.
GlobalProtect hodisa yo'riqnomasi shuningdek, mavjud kirish tuzatishdan keyin ham saqlanib qolishi mumkinligi sababli, yamoqlashdan so'ng faol sessiyalarni tugatishni tavsiya qiladi.
IOC'lar
| Kategoriya | Ko'rsatkich turi | Ko'rsatkich |
|---|---|---|
| MeshCentral C2 | Domen | mesh[.]buttruyen[.]com |
| MeshCentral C2 | IP manzil | 62[.]60[.]131[.]43 |
| AdaptixC2 server | IP manzil | 64.94.85.14 |
| AdaptixC2 server | IP manzil | 168.100.11.99 |
Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.
A widespread campaign targeting FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances to steal credentials, establish persistent access, and exfiltrate corporate data.
The investigation associates the activity with an operator known as k0t and identifies more than 70,000 exposed credentials across network-device records, LDAP dumps and other operational artifacts.
Researchers identified potential connections to the FortiBleed cluster reported in June, with many FortiGate compromises occurring between February and June 2026.
However, the newly uncovered credential dataset was not linked to previously tracked actors, including FortiBleed.
Victim overlaps with Qilin and The Gentlemen suggest possible initial-access brokerage, but direct ransomware affiliations remain unconfirmed.
The operators assemble target lists using FOFA, ZoomEye and underground services supplying product-filtered device addresses.
Their reconnaissance prioritizes exposed VPN and firewall infrastructure rather than specific industries.
Asia Pacific and Latin America account for the largest shares of identifiable victim domains, although researchers caution that exposure patterns, not deliberate regional targeting, may explain this distribution.
General attack chain observed by campaign operators (Source : GroupIB).
A custom Python utility, “FortiGate Security Scanner,” processes target lists concurrently and attempts CVE-2025-64446 exploitation against FortiWeb.
Fortinet describes the vulnerability as relative path traversal enabling unauthenticated administrative command execution through crafted HTTP or HTTPS requests.
According to GroupIB investigation, the scanner creates an administrator account with unrestricted trusted-host access, then validates the credentials.
FortiGate appliances are not vulnerable to this FortiWeb flaw; instead, the tool attempts credential brute-forcing against their REST API.
Its lockout-handling logic pauses blocked targets for 60 seconds before retrying. Following successful authentication, an optional configuration-parsing function downloads appliance settings and decrypts stored secrets using the known default FortiOS AES key associated with CVE-2019-6693.
k0t requests a premium FOFA account or on-demand IP exports from FOFA, ZoomEye and Censys (Source : GroupIB).
Recovered material can include LDAP bind credentials, providing a route from perimeter compromise into Active Directory.
For GlobalProtect, operators use a separate scanner exploiting CVE-2026-0257 through authentication-override cookie forgery.
The vulnerability permits unauthorized VPN connections on affected configurations, requiring authentication override and certificate reuse conditions.
The tooling subsequently invokes OpenConnect to establish network access.
Once inside, operators conduct hands-on-keyboard discovery and credential harvesting using NetExec, Impacket, Kerbrute and Mimikatz.
Observed activity includes extracting Windows secrets, collecting Kerberos service-account hashes and pursuing domain-administrator privileges through noPac and certificate-related attack chains.
Persistence extends beyond VPN access. Researchers identified MeshCentral infrastructure at mesh[.]buttruyen[.]com managing 84 compromised endpoints across 28 active device groups.
Another 100 groups had been removed, preventing those historical entries from establishing a reliable current victim count.
MeshAgents were distributed through agent[.]afahimsa[.]top, separating payload hosting from the management server.
Rclone handled data exfiltration, while AdaptixC2 supplied an additional command-and-control channel alongside abused commercial remote-management tools.
Multiple operator accounts and aliases indicate a collaborative operation, potentially distributing access among intruders or preparing it for sale.
Group-IB’s separate research documents Qilin’s affiliate model and The Gentlemen’s reliance on compromised Fortinet infrastructure, making the observed overlaps relevant without establishing attribution.
Defenders should treat remediation as both vulnerability management and intrusion response.
Apply vendor fixes, review unexpected administrator accounts, investigate unauthorized VPN sessions and remote-management agents, and rotate exposed directory credentials.
GlobalProtect incident guidance also recommends terminating active sessions after patching because existing access may survive remediation.
IOCs
| Category | Indicator type | Indicator |
|---|---|---|
| MeshCentral C2 | Domain | mesh[.]buttruyen[.]com |
| MeshCentral C2 | IP address | 62[.]60[.]131[.]43 |
| AdaptixC2 server | IP address | 64.94.85.14 |
| AdaptixC2 server | IP address | 168.100.11.99 |
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.