cyber.hendryadrian.com
Security News · team-cymru.com

Team Cymru Tracks 21 IPs Running CyberStrikeAI and Observes FortiGate Targeting

· Original article ↗

Summary

Team Cymru says it observed 21 IPs running CyberStrikeAI from January 20 to February 26, 2026, and NetFlow communications targeting Fortinet FortiGate devices. It provides the IPs; suspected Chinese state ties remain an assessment.

Key points

  • Team Cymru observed 21 unique IP addresses running CyberStrikeAI between January 20 and February 26, 2026.
  • The researchers identified the tool on an IP previously shared by Amazon's CTI team and used NetFlow data to observe communications targeting Fortinet FortiGate devices.
  • The listed IPs were hosted across several locations, including China, Singapore, and Hong Kong.
  • Team Cymru assesses that the developer, Ed1s0nZ, has ties to organizations it associates with Chinese government cyber operations; this is an assessment, not confirmation of state sponsorship.
  • The article describes CyberStrikeAI as an open-source AI-native security testing platform integrating more than 100 security tools.

Article Details

Event Type
Observed deployment and use of CyberStrikeAI, an AI-enabled offensive security tool, including reported targeting of Fortinet FortiGate devices.
Impact
Team Cymru observed 21 unique IP addresses running CyberStrikeAI between January 20 and February 26, 2026. One server was observed communicating with and targeting FortiGate devices. The article does not confirm exploitation or compromise. Team Cymru assesses that the developer may have ties to the Chinese government, but does not establish state sponsorship or malicious activity by every observed server.

Indicators of compromise

TypeIndicatorContext
IPV4103[.]164[.]81[.]110Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4106[.]52[.]47[.]65Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4115[.]120[.]233[.]95Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4117[.]72[.]103[.]145Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4118[.]25[.]186[.]119Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4142[.]171[.]160[.]137Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4144[.]31[.]224[.]253Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4146[.]190[.]195[.]154Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4146[.]190[.]82[.]132Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4154[.]219[.]114[.]92Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV4212[.]11[.]64[.]250Team Cymru reports this CyberStrikeAI server was observed targeting Fortinet FortiGate devices.
IPV438[.]38[.]250[.]182Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV443[.]106[.]25[.]225Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV443[.]167[.]237[.]212Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV447[.]101[.]186[.]156Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV447[.]95[.]33[.]207Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV460[.]204[.]227[.]64Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV462[.]234[.]61[.]215Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV464[.]176[.]48[.]93Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV481[.]70[.]144[.]252Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.
IPV62400:d321:2308:1461::1Listed by Team Cymru as a server observed running CyberStrikeAI; malicious use by this host is not confirmed.

People

Ed1s0nZIdentified as CyberStrikeAI's developer. Team Cymru assesses the developer may have ties to the Chinese government based on reported interactions with organizations affiliated with the MSS; this does not establish that the developer conducted malicious cyber activity.

Vendors

FortinetUsing Team Cymru Scout, we can find NetFlow communications between the IP shared by Amazon and its targets, such as the Fortinet FortiGate devices it was observed targeting, as shown in Figure 3 below.

Products

Fortinet FortiGateUsing Team Cymru Scout, we can find NetFlow communications between the IP shared by Amazon and its targets, such as the Fortinet FortiGate devices it was observed targeting, as shown in Figure 3 below.

Tools

CyberStrikeAIidentify malicious operations, and gain actionable intelligence. In this post, we are diving into CyberStrikeAI, an open-source artificial intelligence (AI) offensive security tool (OST) developed by a China-basedInfiltrateXInfiltrateX: A useful privilege escalation scanning tool. While automated detection of privilege escalation vulnerabilities is difficult, prone to occur, and poses serious risks, it can still strive to automate thePrivHunterAIPrivHunterAI: This tool uses a passive proxy approach and mainstream AI (such as Kimi, DeepSeek, GPT, etc.) to detect privilege escalation vulnerabilities. Its core detection function is built on the open APIs of the

Countries

ChinaCyberStrikeAI, an open-source artificial intelligence (AI) offensive security tool (OST) developed by a China-based developer who we assess has some ties to the Chinese government.Hong KongMany of the CyberStrikeAI servers were hosted in Chinese-speaking locals, namely China, Singapore, and Hong Kong. Which is to be expected for a tool developed by a Chinese-speaking coder.SingaporeMany of the CyberStrikeAI servers were hosted in Chinese-speaking locals, namely China, Singapore, and Hong Kong. Which is to be expected for a tool developed by a Chinese-speaking coder.

Related Articles