A new report shows how one hacking group quietly broke into thousands of company firewalls. On 21 October 2026, security firm Group IB and its partner NyxLab revealed a campaign by an actor called k0t that targeted Fortinet and Palo Alto Networks devices and exposed more than 70,000 credentials. The Fortinet and Palo Alto firewall breach matters because these boxes sit at the front door of corporate networks.
Here is what happened in the Palo Alto firewall breach, which devices and flaws the attackers used, and the exact steps admins should take today.
What happened in the Fortinet and Palo Alto firewall breach
According to the Group IB report, k0t scanned the internet in bulk for exposed network equipment instead of picking specific companies. Then it broke in through known software flaws or by guessing weak passwords. Once inside, it pulled saved passwords from device settings and used them to move deeper into victim networks.
- Who found it: Group IB Threat Intelligence, working with NyxLab.
- When: the report came out on 21 October 2026. Many FortiGate compromises date from February to June 2026.
- Scale: more than 70,000 exposed credentials, including network device logins and LDAP directory records.
- Goal: researchers think k0t is likely an initial access broker. In other words, it breaks in and then sells that access to other criminals.
The 70,000 figure does not mean attackers hacked 70,000 companies. Some credentials may not work, and not every organisation suffered a full intrusion. Still, the scale is large enough that every Fortinet and Palo Alto customer should check their devices.
Devices hit in the Fortinet and Palo Alto firewall breach
Three product lines appear in the report:
| Device | How attackers got in |
|---|---|
| Fortinet FortiGate firewalls | Password guessing, then decrypting saved settings with a known default key |
| Fortinet FortiWeb web firewalls | Exploiting CVE-2025-64446 |
| Palo Alto GlobalProtect (PAN OS) | Exploiting CVE-2026-0257 |
By region, Asia Pacific held about 37.6% of victim domains, followed by Latin America. However, Group IB says this reflects where exposed devices sit, not deliberate targeting.
The flaws behind the Palo Alto firewall breach
CVE-2025-64446 (Fortinet FortiWeb)
This is a path traversal flaw in the FortiWeb web interface. It lets an attacker without a password take over an admin account. Fortinet rates it critical, at 9.4 out of 10. Fortinet disclosed it on 14 November 2025 and fixed it in FortiWeb 8.0.2, 7.6.5, 7.4.10, 7.2.12 and 7.0.12. Details are in Fortinet advisory FG-IR-25-910.
CVE-2026-0257 (Palo Alto GlobalProtect)
This flaw lets attackers bypass login on GlobalProtect portals by forging authentication cookies. As a result, they can open an unauthorised VPN connection into the company network. Palo Alto published fixes in May 2026, and CISA added the flaw to its Known Exploited Vulnerabilities list. The Palo Alto advisory lists fixed versions and a workaround.
CVE-2019-6693 (Fortinet FortiOS)
This older issue involves a hard coded encryption key in FortiOS. If an attacker copies a FortiGate configuration file, they can use this known key to decrypt saved secrets. For example, passwords for linked LDAP or Active Directory accounts can leak this way. The fix is to turn on private data encryption with your own key.
How the Palo Alto firewall breach links to FortiBleed and ransomware
This campaign arrives during a busy period for firewall attacks. On 6 October 2026, the FBI and US Secret Service warned that the FortiBleed activity was still hitting exposed FortiGate devices, with attackers adding rogue admin accounts and locking out owners.
Group IB has moderate confidence that k0t links to the wider FortiBleed cluster. However, the credentials barely overlap, so you should not count the two as one event.
Ransomware is the bigger worry. Group IB says some k0t victims later appeared on Qilin and The Gentlemen leak sites, although a direct link is not confirmed. Separately, Palo Alto’s Unit 42 team reports that Qilin and Inc ransomware groups have exploited CVE-2026-0257 in their own attacks.
What admins should do after the Palo Alto firewall breach
Even if you think the attackers missed you, run through this checklist. It combines advice from Group IB, Fortinet, Palo Alto and the FBI.
- Hide management interfaces. Do not expose firewall admin pages to the open internet. Use trusted hosts or a local in policy instead.
- Patch now. Update FortiWeb for CVE-2025-64446 and PAN OS or Prisma Access for CVE-2026-0257. If you cannot patch Palo Alto yet, apply its workaround.
- Encrypt saved secrets. Turn on FortiOS private data encryption with your own key.
- Upgrade password hashing. Move to FortiOS 7.2.11, 7.4.8, 7.6.1 or later, switch admin passwords to PBKDF2 and remove old SHA 256 hashes, as Fortinet explains.
- Reset everything. End all admin and VPN sessions. Then rotate admin, LDAP and Active Directory passwords that the device used.
- Use strong MFA. Phishing resistant multi factor authentication stops most password guessing attacks.
- Hunt for intruders. Look for unknown admin accounts, unexpected API keys and remote tools such as MeshAgent, AnyDesk, Atera or Rclone.
- Report incidents. In the US, report to the FBI or Secret Service. Elsewhere, contact your national cybersecurity agency.
What this means for small businesses
Many small companies buy a firewall once and forget it. Yet this campaign shows attackers do not need to target you by name. If your device is exposed and unpatched, automated scans will find it.
Therefore, set a monthly reminder to check for firmware updates, and ask your IT provider to confirm the admin page is not public. If your website also runs on PHP, our guide to the PHP2Shell vulnerability covers the same patch first habit for web servers. For a broader look at how AI is changing attacks, read our explainer on Gemini 4 Argon and AI security.
FAQ
What is the k0t firewall campaign?
It is a hacking campaign revealed by Group IB and NyxLab on 21 October 2026. The actor k0t broke into exposed Fortinet and Palo Alto devices and exposed more than 70,000 credentials.
Did hackers breach Fortinet itself?
No. The attackers went after customer devices with open admin pages, missing patches or weak passwords. They did not breach Fortinet’s or Palo Alto’s own systems.
How do I know if attackers got into my firewall?
Check for unknown admin accounts, unexpected configuration changes, new API keys and unusual VPN logins. If you find any, reset all credentials and contact your vendor’s support team.
Which patch fixes the Palo Alto flaw?
Palo Alto fixed CVE-2026-0257 in several PAN OS versions, including 12.1.7, 11.2.12 and 11.1.15. Check the official advisory for your exact version.