Morning Threat Brief: 70,000 firewall credentials harvested from the edge

Good morning. The edge is the story today, plus a big-name breach claim that needs a careful read.

1. k0t harvested 70,000+ firewall and VPN credentials. Group-IB and NyxLab disclosed a campaign by a threat actor tracked as k0t that pulled credentials off exposed Fortinet and Palo Alto appliances, using a FortiWeb path traversal flaw (CVE-2025-64446), a GlobalProtect authentication bypass (CVE-2026-0257), and brute force. Victims later showed up on Qilin and The Gentlemen leak sites, which points to an initial access broker role, though the ransomware link is still unconfirmed. If you run FortiGate, FortiWeb, or GlobalProtect: patch now, pull management off the internet, and rotate every credential those boxes can see. Fresh k0t indicators are in the IoC Library.

2. PwC confirmed an incident after Everest claimed 590 GB. Everest claimed the haul on October 22; PwC confirmed on October 23 that a third-party vendor hosting employee learning records was hit, saying no client data, sensitive personal data, or financial information was involved. The 590 GB figure itself is unverified, since PwC declined to confirm it. The takeaway is vendor exposure: a learning platform became the doorway to employee employment-history data.

3. Capcom confirmed a breach of 11.7 million CAPCOM ID accounts. Capcom confirmed the breach on October 24. If you hold a CAPCOM ID account, change that password, enable multi-factor authentication, and watch for phishing built on gaming account details.

4. BlackX UEFI bootkit bypassed Secure Boot. A bootkit from an early 2026 espionage campaign exploited the Baton Drop flaw to bypass Secure Boot and load a driver that interferes with Kaspersky and Avast protections. Enforce Secure Boot validation and apply firmware updates, because a bootkit survives everything else you do, including a reinstall.

Full writeups: kevintswaney.com/vuln-watch
Indicators to hunt: kevintswaney.com/ioc-library

No new CISA KEV additions since yesterday.

← kevintswaney.com