# Global Cyber Campaign Exposes 70,000 Credentials Through Firewall Breaches

*Published October 26, 2026*
*Source: [https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/global-cyber-campaign-exposes-70-000-credentials-through-firewall-breaches) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Cybersecurity experts have uncovered a significant campaign targeting network devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. This campaign has compromised over 70,000 credentials, leading to unauthorized access across numerous global organizations. The campaign, attributed to the hacker known as k0t, also known by several aliases including CryptoFeel and Member19, has been active since October 2025. Investigators from Group-IB and NyxLab revealed that k0t operates with links to ransomware groups such as Qilin and The Gentlemen, potentially acting as an initial access broker.

The attack affected organizations worldwide, with the most significant impact in the Asia Pacific region, followed by Latin America, Europe, and the Middle East and North Africa. The threat actor's method involves scanning for exposed devices rather than targeting individual organizations, making the product type and location of the device more critical than the industry itself. Many organizations affected by this campaign have also been listed on ransomware data leak sites, highlighting the potential for further exploitation.

The campaign's tactics include using legitimate administration tools like NetExec and Mimikatz to deepen access into corporate networks. The investigation suggests minimal overlap between this campaign and another known as FortiBleed, although the activities may be interconnected. Organizations are urged to address any vulnerabilities identified in the report to prevent further breaches and potential data exfiltration.