Over 70,000 exposed credentials linked to a global campaign targeting enterprise firewalls and VPN infrastructure.

A recent investigation by Group-IB and NyxLab has uncovered a large-scale cybercriminal operation targeting internet-facing firewalls and VPN gateways, including Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect environments.

The campaign, attributed to a threat actor known as k0t, involves the exploitation of known vulnerabilities, password brute-forcing, credential harvesting and the establishment of persistent access to corporate networks.

Researchers identified more than 70,000 exposed credentials associated with network devices and LDAP data.

The investigation also uncovered evidence of attackers moving beyond compromised perimeter devices to access internal systems, extract additional credentials, establish remote-control capabilities and exfiltrate sensitive information.

The findings suggest possible connections with ransomware operations, including Qilin and The Gentlemen, although the exact relationship remains unconfirmed.

This incident raises a fundamental question for every enterprise: What happens when the very device responsible for protecting the network becomes the attacker's entry point?

1. The firewall is a critical security boundary, but it is also a high-value target

Enterprise firewalls occupy a privileged position within network infrastructure.

They inspect and control traffic, enforce access policies, terminate VPN connections and frequently maintain trusted relationships with internal authentication services.

Because of this position, a compromised firewall can provide attackers with significant advantages.

Depending on the device's configuration and the privileges obtained, attackers may gain access to network configurations, authentication information, VPN services and internal connectivity.

A firewall compromise is therefore fundamentally different from the compromise of an ordinary endpoint.

When an attacker compromises a firewall, they may gain control over part of the infrastructure that determines who can enter the network and what they can access.

This makes firewall hardening, management-plane protection and continuous integrity monitoring essential.

2. Known vulnerabilities remain a major attack vector

The researchers identified exploitation attempts involving two important vulnerabilities.

CVE-2025-64446: Fortinet FortiWeb

This vulnerability involves a path traversal weakness that can allow unauthorised administrative operations under vulnerable conditions.

The researchers observed an exploit designed to create a new administrator account on affected FortiWeb appliances.

CVE-2026-0257: Palo Alto Networks PAN-OS and Prisma Access

This vulnerability involves an authentication bypass affecting certain GlobalProtect configurations.

Successful exploitation can allow an attacker to establish an unauthorised VPN connection.

These vulnerabilities illustrate two different but equally dangerous outcomes.

One can compromise administrative control over a security appliance.

The other can undermine the authentication mechanism protecting remote network access.

A firewall vulnerability does not need to disable the firewall to create a serious security incident. It may simply allow the attacker to become an authorised user or administrator.

Enterprises must therefore treat actively exploited vulnerabilities in security infrastructure as high-priority remediation items.

3. Exposing firewall management interfaces increases the attack surface

The campaign relied heavily on identifying internet-facing network devices.

Attackers used publicly available scanning services to discover firewall and VPN infrastructure that could be tested for vulnerabilities or weak credentials.

This highlights an important security distinction.

VPN gateways may need to be accessible from the internet to provide remote access.

However, administrative management interfaces generally should not be exposed to arbitrary internet users.

Where remote administration is required, access should be restricted through dedicated management networks, trusted addresses or appropriately secured administrative access mechanisms.

An attacker cannot exploit an internet-exposed management service that is not reachable from their location.

Reducing unnecessary exposure is one of the simplest and most effective ways to reduce risk.

4. Weak credentials can undermine otherwise secure infrastructure

The investigation found that attackers did not rely exclusively on software vulnerabilities.

They also attempted password brute-forcing against exposed network devices.

This demonstrates why patching alone is insufficient.

An appliance may be running current firmware while remaining vulnerable to credential-based attacks if its administrative accounts use weak or reused passwords.

Similarly, compromised credentials may allow access through legitimate authentication mechanisms.

Enterprises should enforce strong authentication, restrict administrative access, implement appropriate lockout controls and use multifactor authentication wherever supported.

Administrative credentials should not be reused across devices or unrelated systems.

A fully patched firewall with compromised administrator credentials is still a compromised security boundary.

5. Firewall configuration files can expose the wider enterprise

One of the most significant findings involves the extraction of configuration information and stored credentials.

Firewall configurations may contain information about internal networks, routing, authentication servers, VPN users and integrated services.

Some configurations may also contain encrypted or otherwise protected secrets.

The researchers described techniques for recovering certain stored credentials after obtaining access to affected devices.

This is particularly concerning because a firewall may integrate with Active Directory, LDAP, RADIUS or other enterprise authentication infrastructure.

If those credentials are exposed, attackers may be able to extend their access beyond the original appliance.

The compromise of one security device can become the compromise of multiple trust relationships.

Organisations should minimise stored credentials, use dedicated service accounts with restricted permissions and protect configuration backups.

Where compromise is suspected, relevant integrated credentials should be rotated.

6. VPN access can turn an external attacker into an internal network user

The campaign involved establishing VPN connectivity to compromised organisations.

This is a critical stage in the attack lifecycle.

Once an attacker obtains a working VPN connection, their traffic may enter the enterprise through a pathway normally reserved for authorised users.

If the VPN provides broad network access, the attacker may be able to discover internal systems, enumerate services and attempt further compromise.

This illustrates a fundamental weakness in traditional perimeter-oriented security.

A successful VPN connection should not automatically grant broad trust across the internal network.

Remote access should be restricted according to user identity, device posture, business requirements and the specific resources being accessed.

Network segmentation and least-privilege policies can reduce the consequences of compromised VPN credentials.

7. Attackers increasingly use legitimate administration tools

The researchers observed the use of remote-management utilities and penetration-testing tools during post-exploitation activity.

These included MeshCentral, Atera, AnyDesk, Impacket and other tools capable of supporting remote access or administrative operations.

Such tools have legitimate uses.

However, attackers can misuse them to maintain access, discover systems and execute commands.

This creates a difficult detection challenge.

Blocking every remote-management tool may disrupt legitimate business operations.

Allowing every remote-management tool without oversight can create unnecessary risk.

Enterprises need policies defining which tools are authorised, who may install them and which destinations they may contact.

Unexpected remote-management agents on sensitive systems should trigger investigation.

Security monitoring must distinguish authorised administration from the unauthorised use of legitimate tools.

8. Network segmentation becomes essential after perimeter compromise

The reported campaign demonstrates that initial access is only the beginning of an enterprise intrusion.

After entering a network, attackers may attempt to identify domain controllers, file servers, databases and other valuable resources.

They may also seek additional credentials or higher privileges.

A flat network makes these activities easier because access to one segment may provide connectivity to many unrelated systems.

Proper segmentation limits the resources reachable from a compromised device or VPN session.

For example, a remote user who requires access to one application should not automatically receive connectivity to domain controllers, backup infrastructure and administrative networks.

The objective of segmentation is to ensure that compromising the perimeter does not automatically compromise everything behind it.

9. Data exfiltration can occur through legitimate cloud services

The researchers observed data exfiltration using Rclone and cloud storage services, including Wasabi S3 and MEGA.

This highlights an important challenge for enterprise security.

Attackers do not always need dedicated malicious infrastructure to transfer stolen information.

They may use legitimate cloud platforms over encrypted connections.

As a result, conventional destination-based blocking may not always distinguish legitimate business activity from unauthorised transfers.

Contextual Data Loss Prevention can help identify certain sensitive information transfers based on content, destination, user identity and policy.

Network monitoring can also identify unusual outbound volumes or unexpected communication patterns.

However, encrypted traffic and approved cloud services can limit visibility unless the appropriate inspection and monitoring controls are deployed.

A connection to a legitimate cloud service does not automatically mean the data being transferred is authorised.

10. Ransomware attacks may begin with access purchased from another criminal

The investigation identified possible links between the campaign and ransomware groups.

This raises the possibility of an initial access broker model.

In such an arrangement, one criminal operation focuses on obtaining access to vulnerable organisations.

That access may subsequently be sold or transferred to other attackers who specialise in data theft, extortion or ransomware deployment.

The precise relationship between k0t and the identified ransomware groups remains unconfirmed.

Nevertheless, the broader security implication is important.

The attacker who compromises a firewall may not be the attacker who ultimately deploys ransomware.

Enterprises must therefore investigate unauthorised access even when there is no immediate evidence of ransomware or significant operational disruption.

An apparently limited firewall incident may represent the early stage of a larger attack.

11. Firewall integrity should be continuously verified

Firewalls are often treated as trusted infrastructure after initial deployment.

Administrators configure policies, enable logging and apply updates periodically.

However, this approach may not be sufficient when attackers actively target the firewall itself.

Organisations should monitor security-sensitive changes, including:

  • Creation of new administrator accounts.
  • Modification of management-access restrictions.
  • Unexpected VPN connections or authentication changes.
  • Changes to security policies and routing configurations.
  • Unauthorised firmware or configuration modifications.
  • Unexpected configuration exports.
  • Suspicious access to authentication-service credentials.
  • Unusual administrative activity outside approved maintenance windows.

Where available, secure boot, firmware integrity verification, signed updates and configuration integrity monitoring can provide additional assurance.

A firewall should not be trusted indefinitely merely because it was securely configured when first installed.

12. What should enterprises do immediately?

The findings justify an urgent review of internet-facing firewall and VPN infrastructure.

Organisations should identify all exposed management and remote-access services, verify firmware versions and apply relevant vendor security updates.

They should also review administrator accounts, rotate potentially compromised credentials and investigate unexpected VPN activity.

Where indicators suggest an actual compromise, incident response must extend beyond the appliance.

Security teams should examine connected authentication services, internal endpoints, remote-management installations and potential data transfers.

Restoring a firewall configuration or applying a patch does not necessarily eliminate access already established elsewhere in the network.

The response to a compromised firewall must consider the entire enterprise environment, not just the affected appliance.

What does this mean for enterprise cybersecurity?

At GajShield, we believe this campaign reinforces the need to treat network security infrastructure as both a defensive control and a critical asset requiring its own protection.

A modern Next-Generation Firewall must do more than inspect traffic.

Its security architecture should also support secure administration, strong authentication, controlled remote access, reliable updates, meaningful audit logs and appropriate protection of stored credentials.

Intrusion Prevention can help detect certain known exploitation attempts.

Threat intelligence can help identify suspicious destinations and emerging attack patterns.

Contextual Data Loss Prevention can help restrict certain unauthorised transfers of sensitive information.

Network segmentation can limit the consequences of compromised access.

These controls must operate together with secure device configuration, vulnerability management and continuous monitoring.

No firewall vendor can reasonably claim that its products are immune to every vulnerability or credential-based attack.

The appropriate measure of security is how effectively a product reduces exposure, protects privileged functions, supports detection and limits the impact of a successful compromise.

The larger cybersecurity lesson

This campaign demonstrates that attackers increasingly view enterprise security infrastructure as a valuable starting point.

A vulnerable firewall can provide administrative access.

A compromised VPN gateway can provide internal connectivity.

A stolen configuration can expose additional credentials.

And a successful foothold can enable persistent access, lateral movement and data exfiltration.

The firewall is no longer simply the barrier attackers try to cross. It is also a high-value system they actively try to compromise.

This creates an important responsibility for enterprises and cybersecurity vendors alike.

Security infrastructure must be hardened, monitored and maintained with the same seriousness as other critical systems.

Because when attackers gain control of the systems responsible for enforcing security, the consequences can extend far beyond the original device.

Your firewall protects your network. But protecting the firewall itself is equally important.

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,

Source: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials via The Hacker News — published 23 Oct 2026.