As cited
Copy frozen at (site build).
threat intel
Risky Bulletin: AI-driven hacking campaign breaches 600+ Fortinet devices
A Russian-speaking threat actor used commercial AI toolkits to compromise over 600 Fortinet FortiGate firewalls starting in January by targeting exposed management ports protected only by weak passwords without multi-factor authentication (MFA). The campaign did not rely on zero-day or legacy vulnerabilities but instead exploited basic security configuration weaknesses. AWS security researchers documented the campaign and its techniques.
Why it matters: Organizations running FortiGate devices should immediately verify that management interfaces are not internet-accessible, enforce strong passwords, and enable MFA to prevent similar attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Risky Bulletin: AI-driven hacking campaign breaches 600+ Fortinet devices
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Risky Bulletin: AI-driven hacking campaign breaches 600+ Fortinet devices
A Russian-speaking financially motivated threat actor compromised more than 600 Fortinet FortiGate firewalls starting in January 2026 using commercial artificial intelligence (AI) toolkits, according to AWS security researchers. The campaign targeted devices with exposed management ports, weak credentials, and no multifactor authentication (MFA), rather than exploiting unpatched vulnerabilities or zero-days.
Why it matters: Organizations running FortiGate firewalls must immediately audit management port exposure, enforce strong passwords, and enable MFA to prevent compromise by this active threat actor.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Risky Bulletin: AI-driven hacking campaign breaches 600+ Fortinet devices
A Russian-speaking financially motivated threat actor compromised more than 600 Fortinet FortiGate firewalls starting in January 2026 using commercial artificial intelligence (AI) toolkits, according to AWS security researchers. The campaign targeted devices with exposed management ports, weak credentials, and no multifactor authentication (MFA), rather than exploiting unpatched vulnerabilities or zero-days.
Why it matters: Organizations running FortiGate firewalls must immediately audit management port exposure, enforce strong passwords, and enable MFA to prevent compromise by this active threat actor.
- Source published
- First seen by Cybersecurity Tracker