Threat feed

k0t edge-device campaign

k0t edge-device credential-theft campaign: FortiWeb/FortiGate/GlobalProtect compromise with offline FortiGate config decryption, MeshCentral and AdaptixC2 persistence, Rclone exfiltration

Posted · Updated · Spectrum Delta Research Team

Summary

Group-IB and NyxLab (Oct 21) document k0t, a multi-operator campaign that bulk-scans internet-facing FortiGate, FortiWeb and GlobalProtect devices, breaks in via a FortiWeb path-traversal exploit creating rogue prof_admin accounts, forged GlobalProtect authentication-override cookies or lockout-aware brute force, then downloads FortiGate configs and decrypts stored LDAP/AD/admin secrets offline with the default FortiOS key — invisible to the appliance. Persistence follows via MeshCentral (84 devices beaconing at analysis time) and AdaptixC2 with AD credential attacks and Rclone exfiltration to Wasabi/MEGA; 70,000+ exposed credentials identified, and victim overlap with Qilin and The Gentlemen leak sites suggests a likely initial-access-broker role (unconfirmed).

Breakdown

Adversary

k0t

Procedures (8)

  1. FortiWeb exploit creates rogue prof_admin local admin

    Path-traversal exploit (CVE-2025-64446) creates a rogue local administrator

    Logs

    • FortiGate/FortiWeb event logs · Admin account creation, auth failures, admin lockouts, trusted-host changes

    Detectors

    No known detector

Click to expand remaining (7) procedures

  1. FortiGate REST-API brute force with lockout-retry cadence

    REST-API brute force with lockout-aware retry

    • T1110.001Brute Force: Password Guessing

    Logs

    • FortiGate/FortiWeb event logs · Admin account creation, auth failures, admin lockouts, trusted-host changes

    Detectors

    No known detector

  2. GlobalProtect VPN sessions via forged auth-override cookies

    VPN sessions established with forged authentication-override cookies (conditional session hunt)

    • T1550.004Use Alternate Authentication Material: Web Session Cookie

    Logs

    • PAN-OS GlobalProtect logs · VPN session establishment, authentication method, client and source address

    Detectors

    No known detector

  3. MeshAgent installed as a Windows service

    Logs

    • Windows event logs / Sysmon / EDR · 7045 installs (MeshAgent); PowerShell staging; Rclone/NetExec; LSASS access

    Detectors

    • Sigma: MeshAgent service install · e0d1ad53 (test): EventID 7045 installs with MeshAgent.exe / 'Mesh Agent'

  4. PowerShell download of AdaptixC2 installer from staging

    PowerShell-based download of the AdaptixC2 agent installer from staging infrastructure

    • T1059.001Command and Scripting Interpreter: PowerShell

    Logs

    • Windows event logs / Sysmon / EDR · 7045 installs (MeshAgent); PowerShell staging; Rclone/NetExec; LSASS access

    Detectors

    No known detector

  5. Kerbrute password spraying against domain controllers

    Logs

    • Domain controller security logs · 4771/4768 Kerberos preauth failures across accounts (spray patterns)

    Detectors

    No known detector

  6. LSASS process access by credential-dumping tools

    LSASS process-access events from credential-dumping tools

    • T1003.001OS Credential Dumping: LSASS Memory

    Logs

    • Windows event logs / Sysmon / EDR · 7045 installs (MeshAgent); PowerShell staging; Rclone/NetExec; LSASS access

    Detectors

    No known detector

  7. Rclone exfiltration to Wasabi S3 and MEGA

    • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

    Logs

    • Windows event logs / Sysmon / EDR · 7045 installs (MeshAgent); PowerShell staging; Rclone/NetExec; LSASS access
    • DNS/proxy/network logs · Beacons to MeshCentral/AdaptixC2 infrastructure, Wasabi S3 and MEGA egress

    Detectors

    • Sigma: Rclone execution · SigmaHQ e37db05d (test): rclone.exe / 'Rsync for cloud storage' + exfil args

Indicators of compromise

Hunt only

Actor network infrastructure: MeshCentral mesh[.]buttruyen[.]com / Meshcentral[.]girydsfsggvb[.]com (62.60.131.43, 62.60.135.64) and agent hosting agent[.]afahimsa[.]top; AdaptixC2 64.94.85.14:4321/endpoint and 168.100.11.99 (BitLaunch AS399629) with listener URIs /update, /api/v1/check, /uri.php and cert O=Internet Widgits Pty Ltd; installer clear-thinking_61.92.4_INSTALL.exe from 162.33.178.213:8888 and sthyjk[.]com:8443; alknene[.]shop; radesashar[.]com; staging 162.33.179.249, 193.24.123.162, 193.149.176.50; scanning 193.169.194.21; file hashes listed in the report (single-origin; count and algorithm mix not re-verified in sources checked); the 70,000+ credential dataset (not published). Assessed 2026-10-24 — forward value not established, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of k0t edge-device campaign? Bring them to the community.

Discuss in the Tradecraft Slack