k0t Exploits FortiWeb and PAN-OS CVEs to Harvest 70k+ Credentials from Exposed Edge Devices

k0t's indiscriminate exploitation of two specific CVEs yielded over 70,000 credentials from edge devices, feeding ransomware affiliates. Evidence shows broad geographic spread and use of living-off-the-land tools rather than custom malware. The activity underscores the ongoing risk from exposed perimeter infrastructure and the gap between observed technical indicators and claimed group affiliations.