VPN Credential Theft: 70,000 Logins Tied to One Broker

A broker called k0t has quietly collected more than 70,000 stolen logins for firewalls and VPN gateways. The new report from Group-IB and NyxLab shows how VPN credential theft turns a perimeter device into a front door for ransomware crews.

What the researchers found

Group-IB’s threat intelligence team and NyxLab published the work on 21 October 2026. They describe a campaign against exposed network edge devices, mainly Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect gateways. The credentials come from network devices and from LDAP dumps, which hold the accounts that link a firewall to a company’s Active Directory.

The actor, tracked as k0t, was first seen in October 2025. Many of the FortiGate compromises date from February to June 2026. The researchers believe k0t is an initial access broker, meaning a seller of footholds rather than a ransomware crew itself. Victims have turned up on the leak sites of the Qilin and The Gentlemen ransomware groups, though the report says the link to k0t is unconfirmed.

How VPN credential theft works in practice

Nothing in this VPN credential theft needs a clever zero-day. k0t finds devices with search engines such as FOFA, ZoomEye and Censys, then tries the easy routes first. Those include a FortiWeb path traversal bug (CVE-2025-64446), a PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) and plain brute-forcing of the FortiGate REST API.

One older trick matters more than it sounds. Configuration files stolen from FortiGates can be decrypted offline with a default key (CVE-2019-6693). That gives the attacker the LDAP bind account, which often has wide read access to the directory.

From there the crew builds a foothold over an OpenConnect VPN, maps Active Directory and installs remote tools such as MeshCentral, Atera and AnyDesk. Data leaves through Rclone to Wasabi and MEGA storage. Group-IB counted 84 compromised devices across 28 active MeshCentral groups when it wrote the report.

Targeting is by product, not by sector

The report says k0t picks targets by scanning for exposed appliances at scale. In its words, “The product and location of an exposed device therefore appear to matter more than the industry.” Asia-Pacific accounts for 37.6% of the domains identified, but the authors say that may simply reflect where exposed devices sit.

For a UK mid-sized business, VPN credential theft is a numbers game, and the lesson is blunt. Nobody is choosing you. A scanner is choosing your firewall, and a stolen login is enough to get inside.

Why edge devices keep winning for attackers

A firewall sits on the boundary. It sees everything, and few people look at it. Endpoint security tools rarely run on the appliance, so a stolen login looks like a normal admin signing in.

Valid credentials also dodge most alerts. Ensar Seker of SOCRadar told Cybersecurity Dive that “many organizations treat perimeter security appliances as trusted infrastructure”. That trust is exactly what a broker sells on.

The same weakness explains the resale market for VPN credential theft. A broker does not need to run the ransomware attack. It sells a working VPN login and a map of the directory, and the buyer does the rest.

Remote tools deserve a closer look too. MeshCentral and AnyDesk are legitimate software, so a security product may not flag them. Only a person who knows what should be installed will spot the odd one out.

Is this FortiBleed again?

Possibly related, but not the same data. In June, researchers reported that leaked logins tied to roughly 74,000 Fortinet devices were being used against organisations worldwide. CISA’s alert told customers to end all active SSL VPN and admin sessions, reset passwords and enforce phishing-resistant multi-factor authentication. The Register reported that researcher Kevin Beaumont confirmed the leaked data was real.

Group-IB assesses a link to that cluster with moderate confidence, yet finds negligible overlap in the credentials. Treat them as two warnings pointing at the same weakness.

What UK organisations should do now

The report’s advice matches CISA’s, and none of it is exotic. Each step makes VPN credential theft harder to pull off.

• Take firewall management pages off the public internet. Reach them over a VPN or from an internal network only.
• Rotate every credential a FortiGate configuration references, starting with LDAP and AD bind accounts. Give those accounts the lowest privilege that works.
• Turn on private-data-encryption on FortiGate with a key you set yourself.
• Require MFA on all VPN and admin logins, and watch for repeated lockouts.
• Patch internet-facing devices quickly, then look in logs for unknown remote-access tools and Rclone traffic.

A network penetration test that starts from the internet will show whether your gateway is exposed, which accounts it leaks and how far a stolen bind account reaches. A tester can also check the Active Directory attack path that sits behind the firewall. If you want that done, you can get in touch with Aardwolf Security.