600+ FortiGate Devices Hacked by AI-Armed Amateur

A financially motivated actor used generative AI to automate scanning and credential abuse against exposed FortiGate management ports, compromising more than 600 devices across 55+ countries. The campaign focused on extracting device configurations and credentials, then targeted Veeam backup servers and Active Directory to obtain elevated access and backup credentials; AWS published IoCs and recommended mitigations such as removing management interfaces from the Internet, enforcing MFA, rotating credentials, and auditing unusual backup or DCSync activity.