Amazon Threat Intelligence reported that a Russian-speaking, financially motivated threat actor used multiple commercial generative AI services to compromise over 600 FortiGate devices across 55 countries. 

Campaign Overview

• Timeline: The activity was observed between January 11 and February 18, 2026.
• The AI Advantage: The actor, described as having “limited technical capabilities,” used AI to generate attack plans, develop custom tools, and automate reconnaissance. This allowed a small-scale operation to achieve the reach typically reserved for sophisticated state-sponsored groups.
• Geographic Impact: Compromised devices were found globally, with concentrations in South Asia, Latin America, the Caribbean, West Africa, and Southeast Asia. 

Attack Methodology

Unlike many high-profile edge device breaches, this campaign did not rely on zero-day exploits. Instead, it focused on “security fundamentals”: 

• Initial Access: The actor scanned for internet-exposed FortiGate management interfaces on ports like 443, 8443, 10443, and 4443.
• Exploitation: Access was gained primarily through brute-force attacks and the exploitation of weak credentials on systems lacking Multi-Factor Authentication (MFA).
• Post-Exploitation: Once inside, the actor extracted full device configurations, including SSL-VPN credentials, network topology, and routing information. This data was used to move laterally into internal networks, targeting Active Directory and Veeam backup infrastructure—a hallmark of pre-ransomware staging. 

Remediation & Defense

Amazon’s CISO CJ Moses emphasized that “strong security fundamentals remain the most effective defense” against AI-augmented threats: 

1. Disable Public Management: Ensure FortiGate management interfaces are not accessible via the public internet.
2. Enforce MFA: Mandatory Multi-Factor Authentication for all administrative and VPN accounts.
3. Audit Configurations: Regularly check for unauthorized accounts or changes in firewall policies.
4. Monitor VPN Logs: Look for logins from unusual geolocations or at unexpected times, particularly those involving administrative accounts.