US Edition
AWS Says 600+ FortiGate Firewalls Hit in AI-Augmented Attack
A financially motivated Russian-speaking actor used AI tools to breach over 600 FortiGate firewalls in 55+ countries, exploiting weak credentials and exposed ports, AWS said.
- On Feb. 20, Amazon Web Services reported compromises of more than 600 FortiGate firewalls between Jan. 11 and Feb. 18 affecting internet-exposed devices globally.
- By scanning internet‑exposed FortiGate management interfaces, the financially motivated actor exploited weak single‑factor authentication, relying on opportunistic targeting rather than product vulnerabilities.
- Investigators found multiple commercial generative AI services were in use, including two different AI tools, with AI-assisted Python scripts and AI-generated planning artifacts on compromised hosts.
- Attackers stole configuration files containing administrator and VPN credentials, then moved into Active Directory environments and targeted backup systems including Veeam servers, raising downstream and ransomware risks to managed service providers.
- AWS warned organisations running FortiGate appliances to avoid exposing management interfaces, change default credentials, enforce MFA, and isolate backups, citing increasing AI‑augmented cybercrime.
13 Articles
13 Articles
Low-Skill Hacker Used AI Tools to Breach FortiGate Devices Globally - Cybernoz - Cybersecurity News
A recent investigation has uncovered a new breed of cybercriminal- the AI-augmented attacker. A Russian-speaking individual, despite having limited technical skills, managed to infiltrate over 600 FortiGate security devices across 55 countries in just over a month. According to findings from Amazon Threat Intelligence, this campaign ran from 11 January to 18 February 2026, and wasn’t the work of a genius. Instead, the attacker used commercial AI…
Russian group uses AI to exploit weakly-protected Fortinet firewalls, says Amazon
A Russian-speaking threat actor is using commercial generative AI services to compromise hundreds of Fortinet Fortigate firewalls, warns Amazon Threat Intelligence. Once on the network, the hackers successfully compromised Active Directory at hundreds of organizations, extracted complete credential databases, and targeted backup infrastructure — a potential precursor to ransomware deployment, the report adds. The report, by CJ Moses, CISO of Ama…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
