Enterprise firewall breach exposes over 70,000 credentials

A large-scale campaign has breached enterprise firewalls and VPNs and exposed more than 70,000 credentials, according to The Hacker News and a joint investigation by Group-IB and NyxLab. The attackers targeted internet-facing network edge devices, then used the access to harvest credentials and establish persistent remote access.

How the attackers got in

Group-IB and NyxLab describe a simple, repeatable attack chain that focuses on exposed devices rather than individual organizations. The actors use public scanning platforms like FOFA and ZoomEye to find internet-facing VPN and firewall appliances, then filter those results by product to build lists of targets. The campaign attempts to exploit known flaws, including a FortiWeb path traversal issue and an authentication bypass in Palo Alto PAN-OS and Prisma Access, and also tries brute-force logins with common username and password pairs. The report names two bespoke Python scripts used in the activity, and says the attackers often gained initial access using an OpenConnect VPN connection.

Once inside, the operators ran standard post-exploitation routines. The researchers say the intruders enumerated Active Directory and SMB, checked installed antivirus products, and used administrator and pentest utilities such as NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to move laterally and harvest credentials. The attackers also installed legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, and used an adversary-emulation framework called AdaptixC2 to maintain persistence. Stolen data was moved out using Rclone to Wasabi S3 buckets and MEGA cloud drives, according to the investigation reported by The Hacker News.

Why the enterprise firewall breach matters to you

The investigators found victims across many sectors and countries, because the attackers selected targets based on exposed device type and location rather than business function. The report gives regional concentrations: about 38 percent in the Asia Pacific region, 31.9 percent in Latin America, 15.8 percent in Europe, and 12.7 percent in the Middle East and North Africa. The actor behind the activity is identified as k0t, who uses several aliases and is assessed to operate as an initial access broker or affiliate. Researchers also note links between these accesses and later ransomware listings from groups such as Qilin and The Gentlemen, though the exact relationship is unclear. The investigation warns organisations to treat these findings as actionable and to remediate the vulnerabilities described.

Practical steps to take now

Follow these general steps to reduce your immediate risk. They reflect common-sense measures that follow from the techniques described by Group-IB and NyxLab.

• Inventory internet-facing VPN and firewall appliances and confirm whether any are exposed to public scanning services.
• Apply vendor updates and configuration fixes for the vulnerabilities named in the report, and follow vendor hardening guides.
• Rotate passwords and keys for any devices or service accounts that could be affected, and remove or disable default accounts.
• Enable multi-factor authentication for remote access where supported, and limit administrative access to specific IP ranges where possible.
• Check logs and endpoint detections for signs of OpenConnect sessions, use of the listed tools, or unusual outbound transfers to cloud storage like Wasabi or MEGA.
• Review installed agents and remote management tools; disable ones you do not use and investigate unexpected installations.
• If you want a quick external starting point, Start with a free external scan to see which devices are visible from the internet.

What investigators found and what to watch for next

The joint report links the activity to k0t, a threat actor first seen in late 2025, and notes a heavy interest in buying exploit code and premium search accounts for internet scanning engines. The researchers say there is "negligible overlap" between this dataset and a related campaign called FortiBleed, suggesting separate operator activity or distinct access sets within a larger cluster. More than 70,000 exposed credentials and LDAP dumps were tied to this campaign, the investigation found. Researchers recommend organisations act on the specific vulnerabilities identified and assume that exposed appliances could lead to deeper compromise if not remediated.

If you operate firewalls, VPN gateways, or other network edge devices, treat this report as a reminder to limit what you expose publicly, keep devices patched and configured according to vendor guidance, and have an incident plan that includes rotating credentials and checking for persistence mechanisms. The researchers conclude with specific remediation advice: "Organisations are advised to act on ensuring that any vulnerabilities mentioned in this report are appropriately remedied."