k0t breached 924 more Fortinet firewalls, Hudson Rock says
Hacker k0t compromised 924 Fortinet firewalls beyond those first known, Hudson Rock says. The actor holds 40,573 cleartext secrets, including 1,576 Active Directory bind passwords. Fortinet firewall owners should check for compromise and rotate credentials.
What happened
Hacker k0t compromised 924 Fortinet firewalls beyond those first known, according to Hudson Rock. The firm says the actor holds 40,573 cleartext secrets, including 1,576 Active Directory bind passwords.
Why it matters
Cleartext passwords held by the attacker can open a path into corporate systems, including Active Directory, which authenticates users and services. Companies running Fortinet firewalls may have internal credentials exposed without knowing it.
What to do
Check whether the company's Fortinet firewalls were compromised and rotate credentials immediately, especially Active Directory bind passwords.
For the technical team
- Affected
- Firewalls Fortinet comprometidos pelo hacker k0t; 924 dispositivos adicionais além dos inicialmente conhecidos, segundo · Fortinet firewalls; products and versions not specified in the sources.
- Exploitation
- Compromise reported by Hudson Rock: 924 firewalls beyond those first known. Actor k0t holds 40,573 cleartext secrets, including 1,576 Active Directory bind passwords. No mention of PoC or KEV in the sources.
- Fix
- Not cited in the sources.
- More details
- Update disclosed on October 28, 2026 by Hudson Rock and shared by IntCyberDigest. The new count adds 924 devices to the previously known k0t total. Intrusion vector and attack timeline are not described in the sources.
Timeline
Hudson Rock raises by 924 devices the count of Fortinet firewalls breached by k0t and details the 40,573 held secrets.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
