Fortinet FortiGate Devices Targeted by CyberStrikeAI, Allowing Hackers to Bypass Security

Team Cymru uncovered CyberStrikeAI—an open-source, AI-native offensive security/orchestration tool—being used at scale to target Fortinet FortiGate devices, with over 600 appliances reportedly compromised across 55 countries; the campaign exploited exposed management ports and weak single-factor authentication rather than zero-day flaws. The developer (GitHub user Ed1s0nZ) is tied by researchers to Chinese state-affiliated projects, many malicious servers were hosted in China/Singapore/Hong Kong, and Team Cymru provides IoCs (e.g., 212.11.64.250, port 8080) and mitigation steps including disabling internet-exposed management interfaces and enforcing MFA.