Russian Cyber Threat Actor Uses GenAI to Compromise Fortinet Firewalls

AWS Threat Intelligence reported a low-skilled, financially motivated actor leveraged commercial generative AI to scale a campaign (11 Jan–18 Feb 2026) that compromised over 600 FortiGate management interfaces across 55+ countries by scanning exposed interfaces and reusing credentials. After gaining VPN access the actor used AI-assisted reconnaissance and common offensive tools (Meterpreter/Mimikatz, Nuclei, gogo scanner) to extract credentials, perform lateral movement and target backup infrastructure; AWS noted no FortiGate vulnerability exploitation and recommended patching, credential hygiene, segmentation and post-exploitation detection.