Disclosure: October 21, 2026

Research organizations: Group-IB and NyxLab

Classification: Cybercriminal intrusion cluster / suspected initial access broker

Priority: High

A joint investigation published October 21, 2026, establishes a substantial operational profile for k0t, connecting previously observed underground identities with widespread exploitation of enterprise firewalls, VPN infrastructure, credential theft, persistent remote access, and subsequent ransomware victimization.

The investigation identified more than 70,000 exposed credentials, including network-device credentials and LDAP-related data. Researchers also identified 84 compromised devices actively communicating with one attacker-controlled management server.

Why this qualifies: Group-IB and NyxLab have publicly characterized k0t as a distinct operational cluster, with infrastructure, tooling, victimology, and preliminary operator relationships. This is a newly documented threat-cluster profile, not evidence that the criminal organization itself was formed recently. Group-IB

Actor intelligence profile

Intelligence field Assessment

Primary designation k0t

Tracking organization Group-IB / NyxLab

Associated aliases CryptoFeel, Member19, QazWsxShop

Possible collaborator Scrooge / ScroogeMcDuck

First observed October 22, 2025

Public research disclosure October 21, 2026

Suspected country/nexus Unknown

Motivation Financially motivated intrusion and possible access brokerage

Suspected operational relationships Qilin and The Gentlemen ransomware ecosystems

State sponsorship No substantiated evidence

Target geography Global

Stated geographic priorities United States, Canada, Europe, selected Asia-Pacific countries

Observed victim distribution Asia-Pacific 37.6%; Latin America approximately 32%; Europe 15.8%; Middle East and North Africa 12.7%

Target sectors Broad, opportunistic targeting across industries

Primary targets FortiGate, FortiWeb, GlobalProtect and other exposed network appliances

Malware / frameworks AdaptixC2, MeshCentral agents

Additional tooling NetExec, Impacket, Mimikatz, Kerbrute, noPac, PetitPotam, OpenConnect, Rclone

Attribution confidence High for documented infrastructure and intrusion activity; uncertain operator relationships

Alias distinction: CryptoFeel and Member19 are associated with the operator\'s underground activity, while Group-IB describes Scrooge as a likely collaborator or potentially another alias. These identities should not automatically be merged into one individual.

The geographic distribution reflects observed exposed infrastructure and victim records. It does not establish deliberate regional targeting or the operators\' physical location. Group-IB

Distinctive TTPs

The cluster conducts internet-scale reconnaissance using FOFA, ZoomEye, Censys, and underground services supplying network-device inventories.

Operators then attempt to exploit exposed appliances or compromise administrative accounts through password attacks.

Initial access: The investigation documents exploitation of CVE-2025-64446 affecting FortiWeb and CVE-2026-0257 affecting certain GlobalProtect configurations.

Credential collection: Following compromise, the operators retrieve appliance configurations, collect stored credentials, enumerate Active Directory, and attempt privilege escalation.

Persistence: The cluster uses MeshCentral agents, AdaptixC2, and legitimate remote-management software.

Lateral movement: Operators employ NetExec, Impacket, and other Windows administration and penetration-testing utilities.

Exfiltration: Rclone transfers collected information to cloud storage services, including Wasabi S3 and MEGA.

Possible ransomware handoff: Several compromised organizations subsequently appeared on ransomware leak sites. The researchers assess that k0t may function as an initial access broker, but a direct commercial or organizational relationship with the ransomware groups remains unconfirmed.