Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

    Thursday, October 22, 2026 In: Threat Research Print

    Date: 10/22/2026

    Severity: High

    Summary

    The threat actor k0t was linked to a large-scale campaign exploiting vulnerabilities and brute-forcing exposed network edge devices, including FortiGate firewalls and Palo Alto GlobalProtect, to gain initial access to organizations worldwide. The investigation uncovered more than 70,000 exposed credentials and evidence of persistent access through OpenConnect VPN, Remote Monitoring and Management (RMM) tools, and AdaptixC2, with some victims experiencing further compromise and data exfiltration. Victim overlaps with ransomware groups such as Qilin and The Gentlemen suggest a possible Initial Access Broker (IAB) role or relationship with ransomware operators, although direct affiliation remains unconfirmed.  

    Indicators of Compromise (IOC) List 

    Domains/URLs

    mesh.buttruyen.com

    Meshcentral.girydsfsggvb.com

    radesashar.com

    http://193.149.187.81:1287/1.exe

    http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe

    https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe

    https://agent.afahimsa.top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&installflags=0

    IP Address

    62.60.131.43

    62.60.135.64

    64.94.85.14

    168.100.11.99

    162.33.179.249

    193.24.123.162

    193.149.176.50

    193.169.194.21

    Hash

    5318f29ef434341d989d543b14fd2a48

    20dc8f1b8a313336c14e03bcb71ff6c8

    032473db4d66748eab524effe57a661d

    13367fbba4344de87de418ab17de76f0

    197f2621c80da7974c56d2ff1921e994

    6f5d18157425aa9697913ae1310f588f

    0dc1af7cfd336a7f075228defc730082

    b39cf70a0194d32e00d7812c29ae1d6add77b823

    bfd864ec0e6bd912f932e4f3ed80687736ee16e8

    e47a2b7ca6a8c009962871dbb667d128ad6b6162

    f05daaf66b200672d679a5ced8b67d4b48a4906e

    b686a811ad89671fbdb448d65f79488d2e562265

    e2c96e603323d8fc7c08678b793d56554faa6914

    6546801898d0b32f5050f49c5302f0366d630cc9

    158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a

    1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d

    4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d

    552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21

    f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e

    39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e

    808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection  

    Detection Query 1 :

    domainname like "https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe" or url like "https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe" or siteurl like "https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe" or domainname like "https://agent.afahimsa.top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfToauq8StiVu0p6ND&installflags=0"orurllike"https://agent.afahimsa.top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfToauq8StiVu0p6ND&installflags=0" or siteurl like "https://agent.afahimsa.top/meshagents?id=4&meshid=DSZSDHzU1YSP83eNnHzSUfPPt5MFUC3UadztK7UJWbWttVfTo$auq8StiVu0p6ND&installflags=0" or domainname like "http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe" or url like "http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe" or siteurl like "http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe" or domainname like "Meshcentral.girydsfsggvb.com" or url like "Meshcentral.girydsfsggvb.com" or siteurl like "Meshcentral.girydsfsggvb.com" or domainname like "mesh.buttruyen.com" or url like "mesh.buttruyen.com" or siteurl like "mesh.buttruyen.com" or domainname like "http://193.149.187.81:1287/1.exe" or url like "http://193.149.187.81:1287/1.exe" or siteurl like "http://193.149.187.81:1287/1.exe" or domainname like "radesashar.com" or url like "radesashar.com" or siteurl like "radesashar.com"

    Detection Query 2 :

    dstipaddress IN ("62.60.135.64","64.94.85.14","193.149.176.50","193.24.123.162","193.169.194.21","168.100.11.99","162.33.179.249","62.60.131.43") or srcipaddress IN ("62.60.135.64","64.94.85.14","193.149.176.50","193.24.123.162","193.169.194.21","168.100.11.99","162.33.179.249","62.60.131.43")

    Detection Query 3 :

    md5hash IN ("6f5d18157425aa9697913ae1310f588f","5318f29ef434341d989d543b14fd2a48","13367fbba4344de87de418ab17de76f0","032473db4d66748eab524effe57a661d","20dc8f1b8a313336c14e03bcb71ff6c8","197f2621c80da7974c56d2ff1921e994","0dc1af7cfd336a7f075228defc730082")

    Detection Query 4 :

    sha1hash IN ("bfd864ec0e6bd912f932e4f3ed80687736ee16e8","6546801898d0b32f5050f49c5302f0366d630cc9","e2c96e603323d8fc7c08678b793d56554faa6914","e47a2b7ca6a8c009962871dbb667d128ad6b6162","b686a811ad89671fbdb448d65f79488d2e562265","f05daaf66b200672d679a5ced8b67d4b48a4906e","b39cf70a0194d32e00d7812c29ae1d6add77b823")

    Detection Query 5 :

    sha256hash IN ("158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a","39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e","552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21","f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e","4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d","1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d","808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c")

    Reference:    

    k0t Exploits Network Edge Access                                                            


    Tags

    MalwareThreat ActorVulnerabilityExploitFortinetCredential HarvestingRMMAdaptixC2ExfiltrationQilinRansomware

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.