Russian-speaking hacker uses AI to breach 600+ FortiGate firewalls
Amazon Threat Intelligence reported that a Russian-speaking hacker used commercial AI tools to compromise over 600 organizations across 55 countries by brute-forcing FortiGate firewalls between January and February 2026. The attacker, described as unsophisticated but AI-augmented, extracted credentials and targeted backup systems, demonstrating how AI services can lower barriers to entry for cyberattacks.
What happened
A Russian-speaking hacker compromised more than 600 organisations across 55 countries using FortiGate firewalls between January 11 and February 18, 2026, according to Amazon Threat Intelligence.
The attacker used commercial AI tools to automate brute-forcing with weak credentials, data parsing, reconnaissance, and lateral movement. The campaign targeted Veeam backup servers and extracted complete credential databases from compromised Active Directory environments.
Reported impact
More than 600 organisations across 55 countries were compromised. The attacker successfully extracted complete credential databases and targeted backup infrastructure, reportedly a potential precursor to ransomware deployment.
Index analysis
Amazon stated the threat actor was 'unsophisticated' and 'likely a financially motivated individual or small group' with no known association with advanced persistent threat groups. The hacker abandoned hardened systems and moved to softer targets when encountering sophisticated defensive measures, indicating their advantage lay in AI-augmented efficiency rather than deeper technical skill.
Governance controls
Amazon described the operation as an 'AI-powered assembly line' that lowered the technical barrier to entry for offensive cyber capabilities. Commercial AI services enabled an individual with limited technical skills to achieve an operational scale that would have previously required a significantly larger and more skilled team.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.