Compromised 600+ FortiGate Devices Globally by AI-Assisted Threat Actor

Feb 21
2 min read

Key Findings

A Russian-speaking, financially motivated threat actor has compromised over 600 FortiGate devices located in 55 countries between January 11 and February 18, 2026.
The threat actor leveraged multiple commercial generative AI tools to automate various stages of the attack cycle, including tool development, attack planning, and command generation.
No exploitation of FortiGate vulnerabilities was observed - the campaign succeeded by exploiting exposed management ports and weak credentials with single-factor authentication.
The threat actor is assessed to have limited technical capabilities, which they overcame by relying on AI to scale their operations.
The AI-powered "assembly line" allowed the threat actor to rapidly scan for and compromise vulnerable FortiGate appliances, with a focus on "easy pickings" rather than persistence in hardened environments.

Background

The threat actor, believed to be a financially motivated individual or small group, utilized AI as a force multiplier to bridge their skill gap and achieve an operational scale that would have previously required a much larger and more skilled team.

Amazon's investigation revealed that the attackers have successfully compromised multiple organizations' Active Directory environments, extracted complete credential databases, and even targeted backup infrastructure - likely as a precursor to ransomware deployment.

Attack Methodology

The threat actor systematically scanned the internet for exposed FortiGate management interfaces on ports 443, 8443, 10443, and 4443.
They then attempted to authenticate using commonly reused credentials, exploiting the lack of multi-factor authentication on the targeted devices.
Once access was gained, the threat actor deployed custom reconnaissance tools written in Go and Python, which displayed clear indicators of AI-assisted development.
Stolen data, including device configurations, credentials, and network topology, was then used to burrow deeper into the targeted networks and conduct post-exploitation activities.

Targeted Regions and Sectors

The activity was sector-agnostic, indicating an automated mass scanning approach for vulnerable FortiGate appliances. Compromised clusters have been detected across South Asia, Latin America, the Caribbean, West Africa, Northern Europe, and Southeast Asia.

Indicators of Compromise

The scanning activity originated from the IP address `212.11.64[.]250`.

Conclusion

The emergence of this AI-assisted threat actor highlights the growing trend of cybercriminals leveraging generative AI to scale their operations and overcome technical limitations. The ability to rapidly generate custom tooling and automate complex tasks has lowered the barrier to entry for unsophisticated actors, posing a significant challenge for defenders.

As the use of AI in cybercrime continues to evolve, it is crucial for organizations to prioritize fundamental security controls, such as multi-factor authentication and network segmentation, to mitigate the risks posed by these AI-powered attacks.

Sources

https://thehackernews.com/2026/02/ai-assisted-threat-actor-compromises.html
https://creati.ai/ai-news/2026-02-21/ai-assisted-hacker-breaches-600-fortigate-firewalls-55-countries-amazon/
https://www.linkedin.com/posts/countermeasures-group_ai-augmented-threat-actor-accesses-fortigate-activity-7430975201741348864-FIOd