AI-Assisted Campaign Compromises 600+ FortiGate Devices Globally

AI-Assisted Threat Actor Compromises 600+ FortiGate Devices in 55 Countries

Amazon Threat Intelligence identified a Russian-speaking threat actor using commercial generative AI to scale attacks against FortiGate appliances. The campaign successfully breached over 600 devices in 55 countries by exploiting fundamental security gaps rather than zero-day vulnerabilities.

Why This Matters

This incident highlights the emergence of the AI-powered assembly line for cybercrime, where low-skill actors achieve the operational scale of state-sponsored groups. While technical models emphasize sophisticated defense, this campaign proved that AI allows even novice attackers to systematically exploit basic hygiene failures like exposed management ports (443, 8443) and single-factor authentication across 55 countries.

Key Insights

• Amazon Threat Intelligence tracked the AI-augmented campaign between January 11 and February 18, 2026.
• The threat actor utilized commercial generative AI for tool development, attack planning, and command generation to bridge technical skill gaps.
• Reconnaissance involved automated mass scanning of FortiGate ports 443, 8443, 10443, and 4443 from IP address 212.11.64[.]250.
• Post-exploitation activities included DCSync attacks for domain compromise and lateral movement via pass-the-hash and NTLM relay.
• Targeting of Veeam Backup & Replication servers was observed, specifically exploiting vulnerabilities like CVE-2023-27532 and CVE-2024-40711.

Practical Applications

• Infrastructure Hardening: Disable internet-facing FortiGate management interfaces and enforce multi-factor authentication for all VPN access. Pitfall: Relying on single-factor authentication allows AI-driven credential stuffing to succeed rapidly.
• Backup Protection: Isolate backup infrastructure from the general network and monitor for unauthorized access to Veeam servers. Pitfall: Unpatched backup servers provide a direct path for threat actors to neutralize recovery options before ransomware deployment.

References:

• http://thehackernews.com/2026/02/ai-assisted-threat-actor-compromises.html