Cyber Threats on the Rise: An Analysis of Recent Attacks on FortiGate Devices

Understanding the Threat Landscape

Recent findings from Amazon Threat Intelligence reveal alarming activity by a Russian-speaking cybercriminal group that has successfully compromised over 600 FortiGate devices across 55 countries. This campaign unfolded between January 11 and February 18, 2026, showcasing the evolving nature of cyber threats in the age of generative artificial intelligence.

Exploiting Basic Security Gaps

Interestingly, this attack did not hinge on sophisticated exploits of FortiGate vulnerabilities. According to CJ Moses, Chief Information Security Officer (CISO) of Amazon Integrated Security, the threat actors leveraged exposed management ports and weak credentials enabled by single-factor authentication. This fundamental oversight in security allowed an otherwise unsophisticated actor to carry out a large-scale operation effectively.

The Role of Generative AI

The attackers demonstrated limited technical capability, but they turned to commercial generative AI tools to assist them at various stages of their campaign. They relied on one primary tool while using another as a backup for navigating within compromised networks. While the specific names of these AI tools remain undisclosed, their impact is significant.

The use of AI in this context underscores a broader trend: even less experienced hackers can now scale their operations with the aid of generative technology. Such tools empower them to devise attack methodologies that would have been beyond their reach just a few years ago.

Financial Motivations and Operational Strategies

This particular group appears to be financially motivated, lacking the backing of advanced persistent threat (APT) operators with state-sponsored resources. The attackers used AI to achieve operational efficiency, allowing them to conduct significant breaches with a minimal team. Their capability to compromise entire Active Directory environments and extract complete credential databases poses a severe risk for targeted organizations.

Shifting Targets: A Strategy of Evasion

Rather than attempting to persist in environments with robust security measures, the threat actors strategically opted for softer targets. This decision reflects a clever use of AI to navigate their limitations and select vulnerable victims, thus increasing their chances of success.

Amazon’s investigation uncovered that the attackers had managed a publicly accessible infrastructure which hosted various artifacts related to their campaign. This included AI-generated attack plans and custom tools, painting a picture of an “AI-powered assembly line for cybercrime.”

Technical Details of the Attack

The attacks primarily focused on breaching FortiGate appliances, extracting vital information like device configurations, credentials, and network topologies. The attackers conducted extensive scans of FortiGate management interfaces across several ports and made attempts to authenticate using frequently reused credentials.

The scanning activity detected the compromise of multiple devices managed by the same organization, highlighting the campaign’s extensive reach across several regions, including South Asia and Latin America. Interestingly, these scans originated from a specific IP address, implying a planned and systematic approach.

Post-Exploitation Activities

Once access was gained, the attackers executed various post-exploitation activities. These included using tools for reconnaissance and vulnerability scanning, targeting backup infrastructure, and attempting to open pathways for ransomware deployment.

Detailed analysis of the source code employed by the attackers illustrated signs of AI-assisted development, which included overly simplistic architectures and rudimentary coding practices. Such details reveal that while the actors might lack advanced technical skills, they are efficiently navigating the complexities of cybercrime with AI help.

Best Practices for Cyber Resilience

Given the increasing allure of Fortinet appliances for cybercriminals, it is vital for organizations to take proactive measures. Key recommendations include:

1. Restricting Internet Exposure: Ensure that management interfaces are not publicly accessible.

2. Enhancing Credential Security: Change default credentials and regularly update user access passwords.

3. Implementing Multi-Factor Authentication: Apply strong MFA protocols for administrative access.

4. Isolating Backup Infrastructure: Protect backup servers from general network access to minimize risks.

5. Keeping Software Updated: Regularly update all programs to fend off potential vulnerabilities.

6. Monitoring for Unusual Activity: Conduct audits to detect unauthorized accounts or connection attempts.

As the trend of AI-fueled cyber threats is expected to intensify, organizations must reinforce their defensive strategies. Focusing on fundamentals such as patch management and robust network segmentation can serve as effective counters against these evolving threats.