Affected Systems

Fortinet FortiGate and FortiWeb firewalls, Palo Alto Networks GlobalProtect, PAN-OS, and Prisma Access. Exploited vulnerabilities: CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS/Prisma Access authentication bypass). Global victims across all sectors, concentrated in APAC (38%), Latin America (31.9%), Europe (15.8%), and MENA (12.7%). Campaign active February–June 2026.

Exploitation Status

Active exploitation confirmed. Threat actor k0t (aliases: CryptoFeel, Member19, QazWsxShop) has been exploiting CVE-2025-64446 and CVE-2026-0257 using custom Python scripts (fortnew.py, exploit_2026_0257.py) since at least February 2026. Over 70,000 credentials harvested. Victims later targeted by Qilin and The Gentlemen ransomware groups, indicating initial access broker activity.

Business Impact

Organizations with exposed Fortinet or Palo Alto edge devices face credential theft, persistent remote access via legitimate tools (MeshCentral, Atera, AdaptixC2), Active Directory enumeration, and data exfiltration to Wasabi S3 and MEGA. Compromised credentials enable lateral movement using Mimikatz, Impacket, and NetExec. Victims may subsequently face ransomware deployment by Qilin or The Gentlemen. Indiscriminate targeting means all sectors are at risk if devices are internet-facing and unpatched.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately patch CVE-2025-64446 on all FortiWeb appliances and CVE-2026-0257 on PAN-OS and Prisma Access devices per vendor advisories.
  • Audit all internet-facing Fortinet and Palo Alto devices for indicators of compromise: check for unauthorized OpenConnect VPN sessions, unexpected remote access agents (MeshCentral, Atera, Teramind, AnyDes), and AdaptixC2 artifacts.
  • Review firewall and VPN authentication logs for brute-force attempts and anomalous logins between February and June 2026; reset credentials for any accounts showing suspicious activity.
  • Block outbound connections to Wasabi S3 and MEGA cloud storage from edge devices and monitor for Rclone usage in network traffic.
  • Hunt for post-exploitation tools in your environment: NetExec, Mimikatz, Impacket, noPac, Kerbrute, PetitPotam, and SoftPerfect Network Scanner. Review Active Directory and SMB access logs for lateral movement.