AI-assisted attacker took over 600+ FortiGate firewalls without a single exploit
An attacker using commercial AI models compromised over 600 FortiGate devices in 55+ countries through exposed admin ports and reused passwords, not CVEs.
- Published
- Updated
- Ecosystem
- Network edge
- Exploitation
- Yes, credential abuse; no FortiGate vulnerability was exploited
What happened
On 20 February 2026, Amazon Threat Intelligence reported a financially motivated, Russian-speaking actor who compromised more than 600 FortiGate devices in more than 55 countries between 11 January and 18 February 2026 (AWS Security Blog).
Amazon was explicit that “no exploitation of FortiGate vulnerabilities was observed”. The actor scanned for management interfaces on ports 443, 8443, 10443 and 4443 and tried commonly reused credentials against devices with single-factor authentication. CVEs appeared in the actor’s notes, but its attempts to exploit them largely failed.
The AI did not write exploits. The actor used at least two commercial language-model providers to plan attacks, build reconnaissance tools in Go and Python, write parsers for FortiGate configurations, generate command sequences for moving through victim networks, and write up its own reports. Amazon called the gain “AI-augmented efficiency and scale, not deeper technical skill”.
Am I affected?
Check what your infrastructure exposes, from the outside and in code:
# From a machine outside your network: are admin ports open on your edge IPs?
nmap -Pn -p 443,4443,8443,10443 YOUR_EDGE_IP
# In Terraform: security groups or firewall rules open to the world
grep -rnE '0\.0\.0\.0/0|::/0' --include='*.tf' .Review every match by hand. A public web server on 443 is expected; an admin interface on any port is not.
What to do now
- Take management interfaces off the internet. Put them behind a VPN, a bastion host or an out-of-band network, or at minimum restrict them to known source IP ranges.
- Require MFA for every administrative and VPN login. Single-factor admin access is what made this campaign work.
- Kill reused and default credentials. Rotate VPN credentials, and check for passwords shared between VPN and directory accounts.
- Encode the rule in CI. Add a policy check (for example with Checkov, tfsec or OPA) that fails a pull request opening admin ports to
0.0.0.0/0, so the mistake cannot ship again. - Watch for what comes next. Amazon saw the actor go after directory services and backups after getting in. Isolate backup servers and keep immutable copies.
Why this is part of the Vulnpocalypse
Most Vulnpocalypse coverage is about AI finding bugs. This campaign is about AI scaling an attacker who did not need one. The practical lesson is the same: what is exposed matters more than what is vulnerable. A perfectly patched firewall with its admin page on the internet and a reused password is easier to break into than an unpatched one that nobody can reach.