AI-Augmented Cyberattacks Target FortiGate Firewalls Worldwide

Between January 11 and February 18, 2026, a financially motivated, Russian-speaking threat actor compromised over 600 Fortinet FortiGate firewalls across more than 55 countries. This campaign, reported by Amazon Web Services (AWS), marks a significant evolution in cybercrime, as it utilized multiple commercial generative AI (GenAI) services to automate and scale attacks without exploiting technical vulnerabilities. Instead, the attackers targeted exposed management interfaces and weak single-factor authentication credentials, demonstrating how AI can empower less skilled individuals to conduct sophisticated cyber operations.

Silicon RepublicAI-powered campaign compromises 600 FortiGate systems worldwideThreat Actors Leveraged Several Commercial AI Tools to Breach 600 FortiGate FirewallsThreat group leverages LLMs to compromise 600 FortiGate firewallsCybersecurityDiveHacker used AI to breach 600 FortiGate appliances across 55 countries

The threat actor employed AI tools to develop custom scripts for reconnaissance and exploitation. They systematically scanned for internet-exposed management ports and executed credential-based attacks using commonly reused passwords. Once inside, they extracted sensitive configuration files containing VPN credentials, administrative passwords, and network topology data. The attackers utilized AI-assisted Python and Go scripts to parse and decrypt these configurations, facilitating lateral movement within victim networks and attempts to access backup systems, which could indicate plans for ransomware attacks.

Hacker used AI to breach 600 FortiGate appliances across 55 countriesThreat Actors Leveraged Several Commercial AI Tools to Breach 600 FortiGate FirewallsAI-powered campaign compromises 600 FortiGate systems worldwideCybersecurityDiveSilicon RepublicThreat group leverages LLMs to compromise 600 FortiGate firewalls

The operational notes from the attackers revealed a reliance on AI-generated code, characterized by simplistic architecture and redundant comments, which often lacked robustness against edge cases. Despite their limited technical skills, the attackers managed to automate various phases of their operations, including network mapping and vulnerability scanning, allowing them to shift focus to softer targets when encountering stronger defenses.

AI-powered campaign compromises 600 FortiGate systems worldwide

Experts have noted that this incident signifies a turning point in the cyber threat landscape, where AI tools lower the barriers to entry for cybercriminals. Damon Small, a board member at Xcape, Inc., remarked that the campaign represents an "automated assembly-line" approach to cyberattacks, enabling individuals with minimal expertise to conduct large-scale intrusions. Jacob Krell, senior director at Suzu Labs, emphasized that the use of commercial AI has democratized offensive cyber capabilities, making them accessible to anyone willing to invest in these technologies.

Threat Actors Leveraged Several Commercial AI Tools to Breach 600 FortiGate Firewalls

In light of this campaign, AWS has provided several recommendations for organizations using FortiGate appliances to enhance their security posture. These include disabling internet access to management interfaces unless necessary, changing default passwords, implementing multifactor authentication, and regularly reviewing VPN connection logs for unauthorized access. Organizations are also advised to isolate backup infrastructure from main networks to mitigate potential disruptions from cyberattacks.

Hacker used AI to breach 600 FortiGate appliances across 55 countries

While the AWS report indicates that the threat actor did not exploit any FortiGate vulnerabilities, some experts have pointed out that the campaign's timing coincides with other attacks targeting specific vulnerabilities in FortiGate systems. This raises questions about the overall security landscape and the need for improved perimeter defenses.

Threat group leverages LLMs to compromise 600 FortiGate firewalls

• “This activity is distinguished by the threat actor’s use of multiple commercial GenAI services to implement and scale well-known attack techniques throughout every phase of the operations, despite their limited technical capabilities,” — CJ Moses, Chief Information Security Officer, Amazon Integrated Security

Threat group leverages LLMs to compromise 600 FortiGate firewalls

• “Commercial AI has done for cyber offense what the internet did for fraud. It made something that required years of expertise and a skilled team available to anyone willing to subscribe.” — Jacob Krell, Senior Director, Suzu Labs

Threat group leverages LLMs to compromise 600 FortiGate firewalls

This incident underscores the growing threat posed by AI-augmented cybercriminals and highlights the urgent need for organizations to bolster their cybersecurity measures against evolving tactics.

CybersecurityDive