Between mid-January and mid-February 2026, a Russian-speaking cybercriminal group compromised over 600 Fortinet FortiGate firewalls across more than 55 countries. The attackers exploited weak passwords and exposed management ports rather than any new software vulnerabilities. Utilizing generative AI tools, they created reconnaissance tools and scripts in Python and Go, which displayed signs of AI involvement, such as redundant comments and naive JSON handling.
The attackers’ use of AI tools allowed them to operate on a grand scale, previously achievable only by more sophisticated teams. They extracted configuration files containing admin and VPN credentials, moved laterally into Active Directory domains, and targeted systems like Veeam for potential ransomware deployment.
Amazon Threat Intelligence highlighted the operation’s reliance on basic cybersecurity missteps, such as single-factor authentication and exposed management interfaces, stressing the need for improved security practices. Recommendations for defenses against such AI-augmented threats include enforcing multi-factor authentication (MFA), improving credential hygiene, segmenting networks, and ensuring management interfaces are not exposed to the public internet.
The incident serves as a reminder that AI is lowering the barrier for entry to cybercrime, enabling smaller, less skilled groups to execute widespread attacks effectively. Basic security measures remain critical in defending against these increasingly sophisticated threats.

Collections

A Russian-speaking cybercriminal group compromised over 600 Fortinet FortiGate firewalls across 55+ countries between January and February 2026, exploiting weak passwords and exposed management ports rather than new vulnerabilities. The attackers leveraged generative AI to build reconnaissance tools in Python and Go, enabling a smaller, less sophisticated group to operate at a scale previously reserved for advanced threat actors. They extracted admin and VPN credentials, moved laterally into Active Directory environments, and targeted Veeam systems for potential ransomware deployment. Amazon Threat Intelligence attributed the success to basic security failures like single-factor authentication and exposed management interfaces. Recommended defenses include enforcing MFA, improving credential hygiene, network segmentation, and restricting management interface exposure.

AI-Assisted Attack Compromises Over 600 FortiGate Firewalls, According to AWS