CyberStrikeAI Found on Infrastructure Linked to FortiGate Campaign
Summary
Team Cymru says CyberStrikeAI was observed on infrastructure linked to a campaign targeting more than 500 FortiGate devices. Researchers found 21 IPs running the platform and warn its automation may lower barriers to attacks on exposed edge devices.
Key points
- Team Cymru identified a CyberStrikeAI service banner on port 8080 at 212.11.64[.]250, an IP tied to infrastructure used in a campaign that compromised more than 500 FortiGate appliances.
- Researchers observed network communications between that IP and FortiGate devices targeted by the campaign; the infrastructure was last seen running CyberStrikeAI on January 30, 2026.
- Team Cymru observed 21 unique IPs running CyberStrikeAI between January 20 and February 26, 2026, with infrastructure in China, Singapore, Hong Kong, the United States, Japan, and Europe.
- The open-source platform integrates more than 100 security tools with AI agents and orchestration for tasks including vulnerability discovery and attack-chain analysis.
- The researchers warn that AI-driven orchestration could lower the skill barrier for complex attacks and accelerate targeting of exposed firewalls and VPN appliances.
- Team Cymru also identified the developer’s other AI-assisted tools, PrivHunterAI and InfiltrateX; it noted the developer’s interactions with organizations previously linked to Chinese government-affiliated operations, while cautioning that such interactions are not necessarily unusual.
Article Details
- Event Type
- CyberStrikeAI was observed running on infrastructure associated with a campaign that compromised more than 500 Fortinet FortiGate devices.
- Impact
- Team Cymru reported that CyberStrikeAI’s AI agents and orchestration can automate vulnerability discovery and attack chains, potentially lowering the skill barrier and accelerating attacks on exposed edge devices. The article does not report that CyberStrikeAI itself caused the FortiGate compromises.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 212[.]11[.]64[.]250 | Observed running a CyberStrikeAI service on port 8080; the IP was also associated with infrastructure used in the campaign that compromised FortiGate devices. |
People
Vendors
Products
Tools
CyberStrikeAIResearchers report that the open-source AI security testing platform CyberStrikeAI was observed running on the same IP infrastructure used by the threat actor who breached hundreds of Fortinet FortiGate devices.InfiltrateXThe developer alias “Ed1s0nZ” has other AI-assisted tools (PrivHunterAI, InfiltrateX) and showed links to organizations previously associated with Chinese government–affiliated operations.PrivHunterAIThe developer alias “Ed1s0nZ” has other AI-assisted tools (PrivHunterAI, InfiltrateX) and showed links to organizations previously associated with Chinese government–affiliated operations.
Countries
ChinaTeam Cymru detected 21 unique IPs running CyberStrikeAI across China, Singapore, Hong Kong, the US, Japan, and Europe between Jan 20 and Feb 26, 2026.Hong KongTeam Cymru detected 21 unique IPs running CyberStrikeAI across China, Singapore, Hong Kong, the US, Japan, and Europe between Jan 20 and Feb 26, 2026.JapanTeam Cymru detected 21 unique IPs running CyberStrikeAI across China, Singapore, Hong Kong, the US, Japan, and Europe between Jan 20 and Feb 26, 2026.SingaporeTeam Cymru detected 21 unique IPs running CyberStrikeAI across China, Singapore, Hong Kong, the US, Japan, and Europe between Jan 20 and Feb 26, 2026.United StatesAdditional infrastructure was spotted in the United States, Japan, and Europe.