InfoSecBulletin Cybersecurity for mankind
Amazon Threat Intelligence observed that a Russian-speaking hacker used generative AI services to compromise over 600 FortiGate devices in 55 countries between January 11 and February 18, 2026. The attack did not exploit FortiGate vulnerabilities but targeted exposed management ports and weak, single-factor authentication, enabling a less-skilled attacker to exploit these security weaknesses widely.
The threat actor is using various commercial GenAI services to execute and expand familiar attack techniques, even with limited technical skills. Amazon Threat Intelligence shares these insights to help the security community to combat these threats.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
CJ Moses, CISO of Amazon Integrated Security, said the compromised firewalls were observed across South Asia, Latin America, the Caribbean, West Africa, Northern Europe, and Southeast Asia, among other regions.
An AI-powered hacking campaign
The threat actor scanned for FortiGate management interfaces exposed online on ports 443, 8443, 10443, and 4443. They targeted these services opportunistically, not focusing on specific industries.
Once breached, the threat actor extracted the device’s configuration settings, which include:
SSL-VPN user credentials with recoverable passwords
Administrative credentials
Firewall policies and internal network architecture
IPsec VPN configurations
Network topology and routing information
These configuration files were then processed and decrypted using automated tools.
“Following VPN access to victim networks, the threat actor deploys a custom reconnaissance tool, with different versions written in both Go and Python,” explained Amazon.
“Analysis of the source code reveals clear indicators of AI-assisted development: redundant comments that merely restate function names, simplistic architecture with disproportionate investment in formatting over functionality, naive JSON parsing via string matching rather than proper deserialization, and compatibility shims for language built-ins with empty documentation stubs.”
“While functional for the threat actor’s specific use case, the tooling lacks robustness and fails under edge cases—characteristics typical of AI-generated code used without significant refinement.”
by gathering information on the networks, sorting them by size, checking for open ports with the gogo scanner, finding SMB hosts and domain controllers, and using Nuclei to scan for HTTP services.
The campaign targeted Veeam Backup & Replication servers with custom PowerShell scripts and tools for credential extraction, looking to exploit vulnerabilities.
On one of the servers found by Amazon (212[.]11.64.250), the threat actor hosted a PowerShell script named “DecryptVeeamPasswords.ps1” that was used to target the backup application.
As Amazon explains, threat actors often target backup infrastructure before deploying ransomware to prevent the restoration of encrypted files from backups. The threat actors’ “operational notes” also contained multiple references to trying to exploit various vulnerabilities, including CVE-2019-7192 (QNAP RCE), CVE-2023-27532 (Veeam information disclosure), and CVE-2024-40711 (Veeam RCE).
The company advises FortiGate admins to avoid exposing management interfaces online, enable MFA, use different VPN passwords from Active Directory accounts, and strengthen backup systems. Recently, Google noted that cybercriminals are misusing Gemini AI in various stages of their attacks, similar to Amazon’s findings.
Indicators of compromise (IOCs)
| IOC Value | IOC Type | First Seen | Last Seen | Annotation |
| 212[.]11.64.250 | IPv4 | 1/11/2026 | 2/18/2026 | Threat actor infrastructure used for scanning and exploitation operations |
| 185[.]196.11.225 | IPv4 | 1/11/2026 | 2/18/2026 | Threat actor infrastructure used for threat operations |
