Cases › security breach › LR-2026-0312
AI-augmented threat actor compromises 600+ FortiGate devices in 55 countries
Confirmed Why: Amazon Web Services research · Amazon Web Services · 2 independent reports
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: advice only, no fix reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties, with a stated count of two or more affected parties. Over 600 FortiGate devices in 55 countries were compromised.
A financially motivated threat actor used multiple commercial generative AI services to compromise FortiGate devices that Amazon Threat Intelligence observed between January 11 and February 18, 2026. The actor reached over 600 devices in more than 55 countries by exploiting exposed management ports and weak single-factor credentials rather than vulnerabilities. With stolen configuration files, the actor tried to enter victim networks, compromise Active Directory, extract credential databases and reach backup infrastructure. When it met hardened environments it moved on to softer targets. Amazon Threat Intelligence identified the campaign through routine threat intelligence work and shared indicators with partners, and it reports that its response reduced the actor's operational effectiveness.
What happened
What was done
“Implement multi-factor authentication for all administrative and VPN access”
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Infrastructure / targetDid not exist Multi-factor sign-in and password policy
Effective Known flaws patched
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
Other controls for this risk at this layer, not mentioned in the sources: Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Content safety classifiers | L1 Model | Not stated in sources |
| Safety training and refusal | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Known flaws patched | L4 Infrastructure / target | Effective |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Did not exist |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: what the AI was doing, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 6 items from the primary sources
What happened, in order
- 2025-12 Earlier exposure of the same server revealed it hosted a copy of the HexStrike AI offensive framework.
- 2026-01-11 Observed activity window begins: campaign compromising FortiGate devices starts.
- 2026-02-18 Observed activity window ends.
Not dated in the sources:
- Stolen credentials used to connect to victim networks for post-exploitation activity.
- Amazon identified attacker infrastructure through routine threat intelligence operations.
- Press story updated with additional details from a separate research report.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
No loss amounts, record counts, durations, or count of affected organisations are stated, so those fields are left out. Controls J2 and J8 are judged missing or failed from the report's description of single-factor authentication and exposed management ports; the report does not use control names. Remediations listed are recommendations from the report, not changes reported as made by a party.
LR-2026-0312 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON