Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Source AlienVault OTX General
Mentions 2 CVEs
Mentioned vulnerabilities
Description
The threat actor k0t is conducting a large-scale campaign targeting network edge devices from FortiGate, FortiWeb, and Palo Alto GlobalProtect. The campaign exploits known vulnerabilities CVE-2025-64446 and CVE-2026-0257, combined with brute-force attacks, to harvest over 70,000 credentials globally. Post-compromise activities include credential theft, Active Directory enumeration, and data exfiltration using Rclone to cloud storage. Persistence is maintained through tools such as MeshCentral, AdaptixC2, and remote management software like Atera and AnyDesk. The campaign overlaps with ransomware groups Qilin and The Gentlemen, suggesting k0t may act as an Initial Access Broker, though no direct affiliation is confirmed.
Impact
The campaign results in large-scale credential compromise, enabling unauthorized access to network edge devices and internal systems. This facilitates further reconnaissance, data theft, and persistent access within victim environments. The use of multiple persistence mechanisms and remote management tools increases the difficulty of detection and remediation. The exposure of over 70,000 credentials across diverse industries globally indicates a significant risk of widespread operational disruption and potential follow-on ransomware or other attacks.
Defensive guidance
Patch status is not yet confirmed — check the vendor advisories for CVE-2025-64446 and CVE-2026-0257 for current remediation guidance. Organizations should verify that FortiWeb, FortiGate, and Palo Alto GlobalProtect devices are updated according to vendor recommendations. Additionally, monitoring for brute-force attempts and unauthorized use of remote management tools like MeshCentral, AdaptixC2, Atera, and AnyDesk is advised. Credential hygiene and limiting exposure of credentials can reduce impact. No vendor advisory content is provided here to confirm patch availability or official fixes.
MITRE ATT&CK techniques
- T1190Exploit Public-Facing Application · Initial Access (opens in a new tab)
- T1133External Remote Services · Persistence, Initial Access (opens in a new tab)
- T1583.001Acquire Infrastructure: Domains · Resource Development (opens in a new tab)
- T1583.004Acquire Infrastructure: Server · Resource Development (opens in a new tab)
- T1583.006Acquire Infrastructure: Web Services · Resource Development (opens in a new tab)
Indicators of compromise
Domains 7
- file.name
- meshcentral.girydsfsggvb.com
- alknene.shop
- radesashar.com
- sthyjk.com
- agent.afahimsa.top
- mesh.buttruyen.com
URLs 4
- http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe
- https://agent.afahimsa.top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&installflags=0
- https://sthyjk.com:8443/
- https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe
IP addresses 9
- 62.60.131.43
- 193.149.187.81
- 193.169.194.21
- 193.24.123.162
- 162.33.178.213
- 162.33.179.249
- 168.100.11.99
- 193.149.176.50
- 62.60.135.64
Hashes 21
CVEs 5
- CVE-2021-42278
- CVE-2021-42287
- CVE-2019-6693
- CVE-2025-64446
- CVE-2026-0257