Hackers target Fortinet and Palo Alto appliances in global campaign

Cybersecurity researchers have uncovered a global attack campaign targeting internet-facing Fortinet FortiGate and Palo Alto Networks GlobalProtect devices. Beinsure reported that the activity involves unauthorized access, persistent remote connections, and data theft. A joint investigation by Group-IB and NyxLab attributes the campaign to a hacker operating under the name k0t, who has also used the aliases CryptoFeel, Member19, and QazWsxShop. [1]

The campaign targets exposed firewalls and virtual private network appliances by exploiting known security vulnerabilities or weak credentials. According to Beinsure, researchers found evidence of widespread unauthorized access that exposed over 70,000 credentials, alongside possible links to ransomware operations. [1]

As FTMQ Security reported earlier, Palo Alto Networks previously disclosed exploitation of CVE-2026-0257 in PAN-OS and Prisma Access software, which allowed ransomware groups such as Qilin and INC to bypass multi-factor authentication. FTMQ Security also reported earlier that Palo Alto Networks patched CVE-2026-0322, a high-severity zero-day vulnerability in PAN-OS that allowed root code execution on management interfaces. [5][6]

Fortinet is an American cybersecurity company based in Sunnyvale, California, that develops firewalls, endpoint security, and intrusion detection systems. Palo Alto, California, is a city located in Santa Clara County. [2][3]