Hackers have compromised enterprise firewalls and VPN systems worldwide, exposing more than 70,000 credentials and gaining persistent access to corporate networks in a campaign potentially connected to ransomware operations.
A joint report by Group-IB and NyxLab, published October 21, 2026, links the attacks to a threat actor who has targeted Fortinet FortiGate and FortiWeb devices alongside Palo Alto Networks GlobalProtect systems.
Researchers uncovered stolen network credentials, corporate data theft, and evidence of attackers maintaining access to compromised environments. The 70,000 figure refers to exposed credentials and related records, not the number of organizations breached.
The campaign affected organizations across multiple industries and regions, with Asia-Pacific accounting for 37.6% of unique domains identified in the investigation.
How Access Was Gained to Corporate Networks
The attackers used public internet-scanning services to identify exposed firewalls and VPN gateways, then exploited known security vulnerabilities or attempted to break into devices using common passwords.
Their methods included exploiting CVE-2025-64446, a vulnerability affecting Fortinet FortiWeb appliances, and CVE-2026-0257, an authentication bypass flaw affecting certain Palo Alto Networks GlobalProtect configurations. FortiGate devices were also targeted through password-guessing attacks.
After gaining entry, the hackers attempted to steal additional credentials, access internal Windows systems, and obtain higher administrative privileges. To maintain access, they installed remote-management tools such as MeshCentral and Atera, allowing continued control over compromised systems.
Investigators identified a MeshCentral server communicating with 84 compromised devices across 28 active device groups. They also found evidence that stolen corporate information had been transferred to external cloud storage services, including Wasabi and MEGA.
Researchers found that some organizations targeted in the campaign later appeared on ransomware groups’ leak websites, although no direct connection between the attackers and those groups has been confirmed. The attackers may be acting as initial access brokers, gaining entry to corporate networks before transferring or selling that access to other cybercriminals, according to the report.
The campaign also shares similarities with FortiBleed, an earlier credential-harvesting operation targeting Fortinet systems. Despite overlapping activity, researchers found little overlap between the stolen credential datasets.
A compromised firewall or VPN gateway can give attackers access to an organization’s wider network, putting sensitive data at risk and opening the door to further attacks.
To reduce these risks, Group-IB and NyxLab recommend updating affected network appliances, restricting publicly accessible management interfaces, reviewing suspicious VPN activity, and investigating potentially compromised credentials.
Leave a Reply