AI-Automated Campaign Targets Global FortiGate Edge Infrastructure

Campaign Overview

Amazon Threat Intelligence has identified a large-scale, automated campaign targeting Fortinet FortiGate devices. Observed between January 11 and February 18, 2026, the activity resulted in the compromise of over 600 devices globally. The campaign is attributed to a Russian-speaking, financially motivated threat actor utilizing commercial generative artificial intelligence (AI) services to scale exploitation efforts.

Technical Execution and TTPs

The primary vector for this campaign did not involve the exploitation of known CVE-based vulnerabilities in the FortiGate firmware. Instead, the actor leveraged AI services to optimize and automate the following stages of the kill chain:

• Automated Reconnaissance: AI-driven script generation for rapid scanning of internet-facing Fortinet infrastructure across 55 countries.
• Credential Operations: Deployment of AI-refined credential stuffing and brute-force attacks. The actor utilized LLMs to generate more effective password permutations and to troubleshoot automation scripts in real-time.
• Bypass Logic: Adaptation of attack patterns to circumvent basic rate-limiting and signature-based detection mechanisms.

Attribution and Scope

Data indicates the adversary is a financially motivated actor proficient in Russian. The geographic distribution of the 600+ compromised devices suggests a non-discriminatory targeting strategy aimed at establishing a persistent botnet for downstream activities, such as proxying malicious traffic or deploying ransomware.

Mitigation and Defense

Security administrators should prioritize the following hardening measures for FortiOS environments:

• Multi-Factor Authentication (MFA): Enforce MFA for all administrative access to the FortiGate management interface to neutralize credential-based attacks.
• Interface Hardening: Disable administrative access (HTTPS/SSH) on internet-facing interfaces. Utilize Out-of-Band Management (OOBM) or dedicated VPN tunnels for administrative tasks.
• Rate Limiting: Implement strict login rate-limiting and Geo-IP blocking for regions outside of normal operating parameters.
• Log Analysis: Monitor for high-frequency failed authentication events originating from unexpected IP ranges, specifically looking for patterns associated with automated scripting.