AI-Augmented Credential Abuse Campaign Targeting Fortinet FortiGate Devices
February 25th, 2026
High
Our Cyber Threat Intelligence Unit has identified a large-scale intrusion campaign in which a financially motivated, limited-capability threat actor leveraged commercially available generative artificial intelligence (AI) services to compromise more than 600 Fortinet FortiGate firewall devices across more than 55 countries between January 11 and February 18, 2026. This campaign did not rely on zero-day vulnerabilities in FortiGate products; instead, it leveraged weak perimeter security, such as exposed management interfaces and single-factor authentication, at scale. AI-assisted planning, scripting, and automation enabled the actor to scale otherwise well-known intrusion techniques, resulting in widespread access, configuration extraction, credential exposure, and post-compromise network activity. Organizations operating FortiGate appliances should urgently review the exposure of management interfaces, authentication controls, and credential hygiene to reduce the risk of similar compromise patterns.
Technical Details
Severity: High
Threat Type: AI-augmented credential compromise & mass intrusion
Affected Products: Fortinet FortiGate appliances with exposed management interfaces
CVEs: No exploitation of FortiGate vulnerabilities was observed.
Attack Vector:
Internet-exposed management ports on FortiGate devices (e.g., TCP ports 443, 8443, 10443, 4443) were systematically scanned.
Weak credentials and single-factor authentication allowed brute-force or credential abuse to succeed against many devices.
AI-Assisted Operations:
Multiple commercial generative AI tools were used to generate attack plans, exploit scripting logic, automated tool development, and operational sequencing across reconnaissance, authentication attempts, and post-compromise phases.
The threat actor’s tooling, written in both Python and Go, contained indicators of AI generation such as redundant comments, simplistic logic, and minimal edge-case handling.
Post-Compromise Activity:
Configuration Extraction: Compromised devices provided full firewall configurations, including:
Administrative credentials
SSL-VPN user credentials
VPN peer settings
Network topology and policy data
Network Pivoting & Credential Access:
Extracted data facilitated access to internal network environments.
Observed activity included credential harvesting and Active Directory targeting, including NTLM credential extraction and replication-style abuse.
Backup Infrastructure Reconnaissance: Post-compromise behavior included enumeration of backup systems, consistent with pre-ransomware or follow-on intrusion staging.
Impact
Large-scale compromise of enterprise perimeter security devices across multiple regions.
Exposure of administrative and authentication data, increasing the likelihood of downstream credential abuse.
Elevated risk of lateral movement, privilege escalation, and follow-on ransomware activity.
Loss of confidence in perimeter security where basic hygiene, such as MFA and strong passwords, was absent.
Potential operational disruption and increased incident response overhead.
Detection Method
Since the campaign relied on legitimate access methods and dual-use tools, relying solely on IOC-based detection is inadequate. Organizations should prioritize behavioral monitoring and anomaly detection.
Authentication & Access Monitoring:
Repeated failed login attempts against FortiGate management interfaces
Successful administrative logins from unexpected sources or patterns
Anomalous VPN authentication behavior
Network & Infrastructure Telemetry:
Scanning or automated connection patterns targeting management ports
Unusual configuration access or export activity
Identity & Directory Services:
Unexpected Active Directory replication behavior
NTLM credential access anomalies
Suspicious privilege escalation or domain controller interactions
Post-Compromise Indicators:
Sudden credential abuse patterns
Unexplained administrative activity
Backup system reconnaissance or enumeration
Indicators of Compromise
IP Address | Description |
212[.]11[.]64[.]25 | Scanning and operational infrastructure for AI-assisted campaign |
185[.]196[.]11[.]225 | IP associated with attacker infrastructure |
Recommendations
Organizations using Fortinet FortiGate devices should:
Restrict administrative interfaces to trusted management networks only.
Eliminate public internet exposure of management services.
Enforce multi-factor authentication (MFA) for all administrative and VPN access.
Rotate weak, reused, or exposed credentials.
Maintain up-to-date firmware and configuration baselines.
Disable unused services and restrict management access via ACLs.
Segregate perimeter devices from critical internal assets where feasible.
Ensure backup infrastructure is isolated and appropriately protected.
Conclusion
This campaign demonstrates that generative AI tools reduce operational barriers for threat actors by accelerating planning, scripting, and automation. While AI improved their capabilities, attackers continued to exploit security gaps such as exposed management interfaces and weak authentication controls. Maintaining strong defensive measures remains the most effective mitigation strategy. We encourage organizations to secure perimeter devices, enforce MFA, and integrate behavioral detection to reduce the risk of AI-assisted intrusions.