#K0T - Twitter Hashtag

about 16 hours ago

A campaign linked to threat actor #k0t exposed more than 70,000 credentials and related data, including network device credentials and LDAP dumps. The operators targeted internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems at scale, using public scanning services such as FOFA, ZoomEye, and Censys combined with target lists from underground sources to identify potential victims. #ThreatIntel

GroupIB_TI's tweet photo. A campaign linked to threat actor #k0t exposed more than 70,000 credentials and related data, including network device credentials and LDAP dumps. The operators targeted internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems at scale, using public scanning services such as FOFA, ZoomEye, and Censys combined with target lists from underground sources to identify potential victims. #ThreatIntel

1

14

4

1K

Group-IB Global

@GroupIB

about 16 hours ago

Network edge devices can give threat actors a direct path into an organization. In a campaign linked to threat actor #k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified. The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA. Overlaps with organizations later listed by #ransomware groups including #Qilin and #TheGentlemen raise the possibility that the operators may be acting as Initial Access Brokers, although the relationship remains unconfirmed. Read the full technical analysis: https://t.co/lgDyLLR572

0

7

4

3

544