AI-Assisted Cyberattack Breaches 600+ Firewalls Globally in Five Weeks
Amazon reported that attackers used widely available generative AI tools to breach over 600 firewalls across 55 countries in five weeks by exploiting weak security configurations. The attackers, reportedly Russian-speaking and possibly a single individual, leveraged AI to automate vulnerability discovery and targeted basic authentication systems, demonstrating how AI reduces technical barriers for large-scale cyberattacks.
What happened
According to an Amazon security research report, attackers speaking Russian exploited commercially available generative AI tools to breach more than 600 firewalls across 55 countries over a five-week period.
The attackers, possibly numbering only one individual, used AI to rapidly identify and exploit basic security weaknesses such as simple login credentials and single-factor authentication systems. Once inside target networks, attackers typically followed basic automated attack paths and abandoned systems with stronger security measures to seek easier targets.
Reported impact
Amazon security engineering and operations lead CJ Moses stated the breaches showed that AI is creating an efficiency advantage for lower-skill attackers, comparing it to an AI-powered assembly line for cybercrime that enables technically less capable criminals to conduct operations at scale.
Affected devices were geographically distributed across South Asia, Latin America, the Caribbean, West Africa, Northern Europe, and Southeast Asia. Amazon noted the incidents were motivated by clear economic interests and predicted such AI-enhanced threats would become more frequent.
Index analysis
Amazon's report indicates attackers prioritized firewall systems with weak defenses rather than targeting specific industries. Anthropic previously disclosed that an attacker leveraged its technology in a large-scale cybercrime operation affecting at least 17 institutions.
The report did not specify which AI tools were used or identify victim organizations, though researchers noted attackers generally failed when attempting attack methods beyond basic automated pathways.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.