cyber.hendryadrian.com
Security News · therecord.media

Amazon Says AI-Assisted Campaign Compromised More Than 600 FortiGate Firewalls

· Original article ↗

Summary

Amazon researchers say a Russian-speaking actor used commercial generative AI to help compromise more than 600 FortiGate firewalls in 55+ countries, exploiting exposed admin interfaces and weak authentication to steal configurations and reach some internal systems.

Key points

  • Amazon says the campaign ran from mid-January to mid-February and affected more than 600 FortiGate devices across over 55 countries.
  • The actor targeted exposed administrative interfaces and weak authentication, rather than exploiting newly discovered vulnerabilities.
  • Commercial AI services helped generate attack plans, scripts, and operational documentation; Amazon did not identify the services used.
  • Stolen firewall configurations contained passwords and network details that enabled movement into internal systems.
  • In some cases, the actor accessed Active Directory environments and targeted backup systems, which researchers said could indicate preparation for future ransomware attacks.
  • Recovered tools for credential extraction, VPN automation, and scanning often failed outside standard conditions; patched systems and basic defenses sometimes stopped operations.

Article Details

Event Type
AI-assisted opportunistic campaign compromising exposed FortiGate firewalls through weak security configurations.
Impact
Amazon reported that more than 600 FortiGate devices across more than 55 countries were compromised from mid-January to mid-February. Attackers stole device configurations containing passwords and network details, and in some cases reached Active Directory environments and targeted backup systems. Researchers said the backup activity could indicate preparation for future ransomware attacks; no ransomware deployment was reported.

Vendors

FortinetResearchers found a Russian-speaking threat actor used commercial generative AI tools to help compromise more than 600 Fortinet FortiGate firewalls across over 55 countries by exploiting weak security configurations.

Products

Fortinet FortiGateResearchers found a Russian-speaking threat actor used commercial generative AI tools to help compromise more than 600 Fortinet FortiGate firewalls across over 55 countries by exploiting weak security configurations.Microsoft Active Directoryto steal full device configurations and escalate access into internal networks—sometimes reaching Active Directory and backup systems—raising concerns about AI-augmented opportunistic campaigns.

Related Articles