Russian group exploits weak Fortinet firewalls via AI

A Russian-speaking threat group is using commercial AI services to compromise hundreds of Fortinet’s Fortigate firewalls, Amazon Threat Intelligence. Once inside the network, the hackers successfully breach Active Directory across hundreds of organizations, extract complete credential databases, and target backup infrastructure — a potential preparation for ransomware deployment, the report adds.

See also: Fortinet fixes critical vulnerability that allows code execution

The report, by CJ Moses, CISO of Amazon Integrated Security, is another sign that commercial AI services are lowering the technical barrier to entry for offensive cybersecurity capabilities. A single attacker or a very small team created their entire toolkit through AI-assisted development, Amazon says.

But the report is also a reminder to CSOs and IT leaders of all organizations of something they have known for decades: Failure to implement cybersecurity fundamentals will inevitably lead to a breach of security controls. The compromised Fortigate firewalls in this campaign are exploited not through product flaws, but through exposed management ports and weak credentials with only single-factor authentication.

One key tool was the use of a list of commonly reused credentials, also known as a brute-force attack. These were “fundamental security vulnerabilities” that allowed the AI ​​to help an unskilled attacker exploit at scale, the Amazon report says. “When this attacker encountered hardened environments or more sophisticated defenses, it simply moved on to softer targets rather than persisting,” the report says.

“A strong defensive foundation remains the most effective countermeasure” for such attacks, Amazon emphasizes. This includes patch management for perimeter devices, credential hygiene, network segmentation, and robust post-exploit indicator detection.

Jeff Pollard, a principal analyst at Forrester Research who leads research on the role of the CSO, noted that, unlike many other recent attacks on Fortinet, this campaign is about device configuration, not software vulnerabilities in the platform itself. “It’s a case of getting down to the basics, and if anything, it makes those basics more important,” he said.

See also: Fortinet fixes FortiOS SSO bug

Amazon's report comes on the heels of one from Palo Alto Networks that examined 750 incidents and came to the same conclusion: what's really killing organizations isn't so much AI, but their underlying security failures like weak authentication, lack of real-time visibility, and misconfigurations caused by the complex deployment of security systems.

Amazon Threat Intelligence found that the Russian-speaking attacker had managed to compromise over 600 FortiGate devices in more than 55 countries between January 11 and February 18, all without exploiting any vulnerabilities. Instead, he used anonymous commercial AI services, excluding AWS, to compromise weakly protected FortiGate devices. The AI ​​simply helped to escalate the attack.

After stealing administrator credentials, firewall policies, network topology and routing information, and IPsec VPN peer configurations, the attacker used AI-powered Python scripts to analyze, decrypt, and organize these stolen configurations. After gaining VPN access to the victims’ networks, Amazon says the attacker developed a custom network reconnaissance tool, with different versions written in both Go and Python.

Source code analysis reveals clear indicators of AI-assisted development such as redundant comments that simply repeat function names, simplistic architecture with a disproportionate investment in formatting relative to functionality, naive JSON parsing via string matching rather than proper reconstruction, and compatibility with built-in language elements with empty documents. While functional for the perpetrator's specific use case, the tool lacks robustness and fails in edge cases, Amazon says.

Amazon's report makes a number of recommendations to network administrators with Fortinet's FortiGate devices. They include ensuring that device management interfaces are not exposed to the internet, or if they must be, restricting access to known IP ranges, and using a proxy or out-of-band management network. As a basic cybersecurity requirement, all default and shared credentials for FortiGate devices should be changed.

See also: Fortinet: Critical FortiCloud vulnerability not fully patched

They should ensure that multi-factor authentication is implemented for all admin and VPN access and ensure that there is no password reuse between FortiGate VPN credentials and Active Directory domain accounts. To prevent their systems from being exploited, IT administrators in companies using AWS are advised to enable Amazon GuardDuty for threat detection, monitor unusual API calls and credential usage patterns, use Amazon Inspector to automatically scan for software vulnerabilities and inadvertent network exposure, and use AWS Security Hub to maintain continuous visibility into their security.