Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

The report

Group-IB and NyxLab expose threat actor k0t’s large-scale campaign exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials, establish persistent access and exfiltrate data

Read the full analysis: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (Group-IB).

Indicators

Malware C

• mesh[.]buttruyen[.]com
• meshcentral[.]girydsfsggvb[.]com
• radesashar[.]com

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#25). This page is generated from that record and the report’s own title and summary; nothing is rewritten.