Observed incident
AI-assisted actor compromised hundreds of FortiGate devices
Reported
What happened
Amazon reported a Russian-speaking actor using commercial AI services while compromising more than 600 FortiGate devices across over 55 countries during January and February.
Parties and reporting
AI tools and systems: Commercial LLM services, FortiGate, Metasploit, mimikatz
Outcome
Amazon shared indicators and coordinated with partners. The campaign exploited exposed management interfaces and weak credentials; Amazon observed no FortiGate vulnerability exploitation.
Operating lesson
Protect management interfaces, require MFA, and detect credential theft and lateral movement after initial access.
Evidence and limits
Counts and attribution are Amazon's findings. The public report does not name the AI providers; AWS infrastructure was not observed participating in the campaign.
Sources
- Amazon threat investigation
Primary source ·