In a joint investigation published on 23 October 2026, cybersecurity researchers from Group-IB and NyxLab disclosed a large-scale campaign targeting enterprise network edge devices. The operation successfully breached multiple enterprise firewalls and virtual private network gateways, resulting in the widespread exposure of sensitive system information and user access credentials. Security analysts revealed that the malicious activity compromised organizations across multiple global regions.

The campaign has been directly attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop. According to the findings, this operator functions as an initial access broker and maintains operational connections with known ransomware syndicates, specifically Qilin and The Gentlemen. Initial access brokers typically infiltrate corporate perimeters and compile credential caches before selling or handing off access to extortion gangs for downstream deployment.

Technical details from the investigation show that the targeted infrastructure heavily featured exposed enterprise network edge devices, specifically including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The activity resulted in the massive accumulation and exposure of over 70,000 credentials derived directly from compromised network devices as well as subsequent Lightweight Directory Access Protocol dumps obtained during internal network reconnaissance.

Geographic telemetry gathered during the investigation indicates that victim organizations are distributed globally, with approximately 38 percent located in the Asia Pacific region. Latin American entities account for 31.9 percent of the affected organizations, while European victims represent 15.8 percent, and the Middle East and North Africa region accounts for 12.7 percent of the total compromised targets.

A significant portion of the documented victim compromises occurred between February and June 2026, highlighting a sustained period of unauthorized network intrusion before the complete scope of the campaign was mapped out. The exposure of tens of thousands of corporate credentials poses severe follow-on risks to enterprise environments, potentially enabling threat actors to bypass perimeter defenses, escalate privileges, and execute further malicious campaigns against vulnerable networks.

Organizations are advised to ensure that any vulnerabilities associated with the targeted network edge devices mentioned in the report are appropriately remedied. Implementing robust perimeter monitoring, enforcing strict multi-factor authentication, and regularly auditing network gateway access logs remain essential components of an effective defense strategy against sophisticated initial access brokers operating within the modern threat landscape.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news