Amazon Reports AI-Assisted Actor Compromised 600+ FortiGate Devices
Summary
Amazon Threat Intelligence says a financially motivated actor used commercial AI tools to compromise over 600 FortiGate devices in 55 countries from January 11 to February 18, 2026, using exposed management interfaces and weak credentials—not FortiGate vulnerability.
Key points
- Amazon Threat Intelligence attributed the campaign to a Russian-speaking, financially motivated actor or small group; the AI tools used were not named.
- Amazon reported more than 600 FortiGate devices compromised across 55 countries, with scanning of internet-exposed management interfaces on ports 443, 8443, 10443, and 4443.
- The actor reportedly used commonly reused credentials and extracted device configurations; Amazon said it observed no exploitation of FortiGate vulnerabilities.
- Amazon reported Active Directory compromise, credential database extraction, and attempts to access Veeam backup infrastructure, which it assessed as consistent with ransomware preparation.
- Post-compromise activity reportedly included Nuclei scanning, DCSync, pass-the-hash/pass-the-ticket, NTLM relay, and remote command execution.
- Amazon found attacker-hosted AI-generated plans, victim configurations, and custom-tool source code; it described coding patterns it considered indicators of AI-assisted development.
- Recommended defenses include removing internet-facing management access, enforcing MFA, rotating credentials, patching, segmenting networks, and isolating backups.
Article Details
- Event Type
- AI-assisted credential-based compromise campaign targeting exposed FortiGate management interfaces
- Impact
- Amazon Threat Intelligence reported that more than 600 FortiGate devices across 55 countries were compromised. The actor also compromised multiple organizations' Active Directory environments, extracted complete credential databases, and attempted to access Veeam backup infrastructure, activity assessed as likely preparation for ransomware deployment. No FortiGate vulnerability exploitation was observed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 212[.]11[.]64[.]250 | IP address from which the reported FortiGate management-interface scanning originated. |
MITRE ATT&CK
T1003.006 · DCSyncThe actor used DCSync attacks to achieve domain compromise.T1110.001 · Password GuessingThe actor attempted authentication using commonly reused credentials against exposed FortiGate management interfaces.T1550.002 · Pass the HashThe actor used pass-the-hash attacks for lateral movement.T1550.003 · Pass the TicketThe actor used pass-the-ticket attacks for lateral movement.T1557.001 · Name Resolution Poisoning and SMB RelayThe article reports NTLM relay attacks during lateral movement.T1595.002 · Vulnerability ScanningThe actor systematically scanned internet-exposed FortiGate management interfaces and used Nuclei for vulnerability scanning.
CVE
CVE-2023-27532Veeam · Veeam backup & replicationTarget Veeam Backup & Replication servers to deploy credential harvesting tools and programs aimed at exploiting known Veeam vulnerabilities (e.g., CVE-2023-27532 and CVE-2024-40711).CVE-2024-40711veeam · backup_\&_replication; Veeam · Backup and RecoveryTarget Veeam Backup & Replication servers to deploy credential harvesting tools and programs aimed at exploiting known Veeam vulnerabilities (e.g., CVE-2023-27532 and CVE-2024-40711).
People
Vendors
FortinetWith Fortinet appliances becoming an attractive target for threat actors, it’s essential that organizations ensure management interfaces are not exposed to the internet, change default and common credentials, rotateVeeamPost-compromise activity included Active Directory breaches, full credential database exfiltration, and attempts to access Veeam backup infrastructure.
Products
Fortinet FortiGateA Russian-speaking, financially motivated actor used commercial generative AI to automate scanning and brute-force attacks against exposed FortiGate management interfaces, compromising over 600 devices in 55 countries.Veeam Backup & ReplicationTarget Veeam Backup & Replication servers to deploy credential harvesting tools and programs aimed at exploiting known Veeam vulnerabilities (e.g., CVE-2023-27532 and CVE-2024-40711).