FortiWeb Credential Leak: What the k0t Research Means for Your Site

Group-IB and NyxLab have tied more than 70,000 exposed credentials for Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect devices to a threat actor tracked as k0t. This FortiWeb credential leak comes with no CVE to patch, so the fix is in your accounts, sessions and logs, not your firmware update queue.

What did the k0t research actually find?

On 23 October 2026, Group-IB and NyxLab published joint research on a campaign by an actor they track as k0t. The campaign targets internet-facing network appliances: Fortinet FortiGate firewalls, Fortinet FortiWeb web application firewalls and Palo Alto Networks GlobalProtect VPN gateways. The researchers say they found more than 70,000 exposed credentials associated with network devices and LDAP directory data.

Read that number carefully. It counts credential records, not breached companies. One organization can contribute hundreds of accounts, the same account can appear more than once, and some records will be stale.

LDAP is a directory protocol, not a password format, so an LDAP record may hold a username and attributes rather than a working password. The public summary does not say how the total splits between device logins and directory records.

Timing matters more than the headline. Many of the compromises the researchers observed happened between February and June 2026. In the summary’s own words, the publication is new but the underlying attacks are not necessarily new. If an attacker reached your edge device in spring, they may have had months of quiet access before anyone wrote about it.

Several things are still unknown:

• k0t’s country, sponsor or malware family
• Named victims, sectors or a victim count
• Indicators of compromise in the public summary
• Any statement from Fortinet or Palo Alto Networks

The research circulated publicly via a Reddit r/cybersecurity_news post on 26 October. That post appears truncated, so any indicators would be in the full Group-IB and NyxLab report, not in the summary.

How does stolen FortiWeb or VPN access turn into a hacked website?

A firewall or VPN login is worth more than a CMS password because it controls the path to everything behind it. FortiWeb sits directly in front of web applications and decides which requests reach them. FortiGate and GlobalProtect are the remote-access doors into the same network that holds the web servers, hosting panels and databases.

The researchers describe three stages in the incidents they observed:

1. Gaining access to organizations
2. Establishing persistent remote access
3. Exfiltrating data

They also assess that stolen credentials plus continued access can enable lateral movement deeper into corporate networks and later ransomware attacks.

The LDAP data is what widens the blast radius. Many small and mid-sized organizations connect VPN and firewall admin logins to Active Directory or another LDAP directory. If directory accounts are in the leaked set, the same username and password may also open the hosting panel, the staging server or a developer’s WordPress admin, especially where people reuse passwords.

The research does not say how k0t obtained the credentials. It could have been an appliance flaw, password spraying, stuffing with reused passwords, infostealer logs or bought dumps.

Edge VPNs attract exactly this kind of attention: Palo Alto Networks’ CVE-2024-3400 in GlobalProtect scored CVSS 10.0 and was actively exploited in April 2024, and Fortinet’s CVE-2023-27997, a critical FortiOS SSL-VPN heap overflow, was disclosed in June 2023. Neither has been linked to k0t.

Our earlier coverage of a critical FortiWeb zero-day followed the same pattern: the device meant to protect the site became the entry point. CISA’s Known Exploited Vulnerabilities catalog lists several Fortinet and Palo Alto flaws, so use it to confirm your firmware is current. Patching will not remove someone who is already logged in.

Why is a password reset not the same as a cleanup?

On these platforms, an attacker’s persistence lives in the device configuration, not only in a password. With admin access, an attacker can add a second administrator, create extra VPN users, change authentication settings or issue API credentials. Each of these survives a reset of the account they first used.

There is also no patch that answers this research. It gives no CVE, no CVSS score and no fixed FortiOS, FortiWeb or PAN-OS version. A firmware upgrade is not remediation for leaked credentials.

Resetting your WordPress or Joomla admin password does nothing about a VPN account the attacker still holds. It also does nothing about a FortiWeb exception that quietly lets their traffic through.

Leadership has three decisions to make here:

• Who owns the review. If an MSP or your hosting provider runs the appliance, ask them in writing for the February–June 2026 admin and VPN logs.
• Whether data left. The researchers report data theft in the incidents they saw. If you process EU personal data and find evidence of exfiltration, the GDPR 72-hour deadline for notifying your supervisory authority starts when you become aware of a likely breach, so bring in counsel early.
• Insurance. Many cyber policies require prompt notice of a suspected incident. Read yours before the investigation finishes, not after.

What should you check on FortiGate, FortiWeb and GlobalProtect today?

Start with logs and accounts on the appliances, covering February 2026 to today. The public summary contains no IPs, domains, hashes or tool names to match against, so you are looking for behavior, not indicators.

1. Preserve logs first. Export firewall, VPN, admin-login and configuration-change logs to a system the appliance administrators cannot alter, before any reboot or rebuild. A compromised gateway is not a trustworthy place to keep its own evidence.
2. List every admin account on each device and compare it with who should have access.
3. List local VPN users and profiles. Flag anything created during or after the February–June window.
4. Review admin and VPN logins by source, time and location. Watch for staff accounts logging in at hours they never work, or from hosting-provider address ranges.
5. Compare the running configuration with a dated, known-good backup. Look for changed authentication servers, new policies exposing management interfaces, FortiWeb rule exceptions and disabled logging. Don’t blindly restore the old backup, because it may bring back outdated firmware or stale credentials.
6. Check API tokens and integrations that nobody can explain.
7. Match edge activity against the site. Look for new CMS admin users, unknown plugins or PHP files in upload folders, DNS changes, and hosting-panel logins whose timing lines up with VPN sessions.

When we review edge devices after an incident, the attacker’s account is rarely named anything obvious. It is usually a plausible service name, or an old staff account that someone quietly re-enabled. Sort accounts by creation date and last login, not by name.

Finding nothing is not proof the device is clean. The research published no indicators, so the absence of a match means very little.

Which accounts should a site owner rotate first?

Rotate from the edge inward. The credential set includes both device logins and directory data, so stopping at the firewall admin password leaves much of the problem in place.

1. Appliance administrators on FortiGate, FortiWeb and the GlobalProtect portal. Delete unexplained accounts first, then rotate the rest.
2. VPN users. Rotate their passwords and require MFA on every remote-access and admin login.
3. Directory accounts the devices depend on. That means the LDAP bind account the appliance uses plus users who log in through the VPN. Update the bind password on the device at the same time, or VPN logins will break.
4. Hosting panel, SSH/SFTP, database and CMS passwords for anyone who reused a directory password.
5. API keys and shared secrets, such as RADIUS secrets, connected to the appliances.

Then end every active VPN and admin session. A password change does not log out a session that is already open. Finally, restrict appliance management interfaces to a management network or an IP allowlist. An admin login page should never face the open internet.

When does this become a malware-removal job?

It becomes a cleanup job once there are signs the attacker reached the site itself, not just the edge device. A leaked VPN password is an identity incident. A webshell in your uploads folder is a compromised website.

Keep the ransomware angle in proportion. The researchers saw overlaps between k0t victims and organizations later listed by ransomware groups, but they state that the relationship is unconfirmed. No victims, countries or sectors are named.

These signs mean the problem has moved past credentials:

• PHP files in upload or cache directories that you didn’t put there
• CMS administrator accounts nobody created
• Modified core files, injected JavaScript or redirects
• Outbound spam from your server
• New cron jobs or scheduled tasks
• Defacement

If you see any of these, rotating passwords is not enough. Scan the files with a tool like SiteGuarding Antivirus, compare them against clean copies of core files, and decide whether to clean in place or rebuild from a trusted source. Do this before your final password rotation, otherwise a webshell can let the attacker straight back in with the new credentials.

FAQ

What is the k0t campaign against Fortinet and Palo Alto?

It is activity attributed by Group-IB and NyxLab to an actor tracked as k0t that targeted internet-facing FortiGate, FortiWeb and GlobalProtect devices. In observed cases the operators gained access, set up persistent remote access and stole data.

Is there a FortiWeb or GlobalProtect CVE to patch for k0t?

No. The research as summarized names no CVE, CVSS score or fixed version. Keep firmware current anyway, but treat this as a credential and configuration review.

How many credentials did Group-IB and NyxLab find?

More than 70,000 credentials associated with network devices and LDAP data. That is a count of records, not of breached organizations, and some records may be stale or unusable.

Does a VPN password leak put my WordPress site at risk?

It can. If directory or VPN passwords are reused for hosting panels, SFTP or CMS admin accounts, the attacker can reach the site through the trusted network path. Check the site for new admins and unknown files.

Are the k0t operators confirmed to be a ransomware group?

No. Researchers saw overlaps with victims later listed by ransomware groups, but they say the exact relationship is unconfirmed.

How do I check if my GlobalProtect or FortiGate login was stolen?

No public indicators exist, so review admin and VPN logins, account creation dates and configuration changes from February 2026 onward. Rotate credentials and end active sessions regardless of what you find.

If your edge logs or your site files show something you can’t explain, our team can investigate and clean it. See our website protection and hack recovery packages.