AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55 Countries Using LLM-Generated Tooling and Custom MCP Framework — Threadlinqs Intelligence
As of 2026-05-30, AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55 Countries Using LLM-Generated Tooling and Custom MCP Framework is a critical-severity apt threat attributed to a Russia-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0131 · Severity: CRITICAL · Status: MONITORING · Category: APT
Attribution: Russia · FINANCIAL
Amazon Threat Intelligence disclosed a campaign by a Russian-speaking, financially motivated threat actor who breached 600+ FortiGate firewalls across 55+ countries between January 11 and February 18,
## Overview
On February 21, 2026, Amazon Integrated Security (CJ Moses, CISO) published research documenting a Russian-speaking threat actor who compromised 600+ FortiGate firewall appliances across 55+ countries in just 5 weeks (January 11 — February 18, 2026). The campaign was independently corroborated by Cyber and Ramen (Hunt.io research) and reported by BleepingComputer.
This campaign is significant not for sophisticated exploitation — no zero-days were used — but for demonstrating how commercial AI services enable low-to-medium skill actors to achieve nation-state-scale operations. The actor used at least two commercial LLM providers (DeepSeek and Anthropic Claude) throughout every phase of the kill chain: tool development, attack planning, reconnaissance automation, credential extraction, lateral movement planning, and operational documentation.
## Initial Access: Mass Credential Abuse
The actor's initial access was brute-force attacks against FortiGate management interfaces exposed to the internet. Systematic scanning targeted ports 443, 8443, 10443, and 4443, followed by authentication attempts using commonly reused credentials. No FortiGate vulnerabilities were exploited for initial access — the campaign succeeded entirely through exposed management ports and weak/single-factor credentials.
FortiGate configuration files were high-value targets containing: SSL-VPN user credentials with recoverable passwords, administrative credentials, complete network topology and routing information, firewall policies revealing internal architecture, and IPsec VPN peer configurations. The actor developed AI-assisted Python scripts to parse, decrypt, and organize stolen configurations.
## Geographic Distribution
The campaign's targeting was opportunistic rather than sector-specific, consistent with automated mass scanning. Concentrations of compromised devices were observed across South Asia, Latin America, the Caribbean, West Africa, Northern Europe, and Southeast Asia. Patterns of contiguous IP blocks and shared non-standard management ports indicated MSP deployments and large organizational networks.
Confirmed compromises included an industrial gas company in Asia-Pacific, a telecom provider in Turkey, and a major media company in Asia. Additional reconnaissance referenced targets in South Korea, Egypt, Vietnam, Kenya, and a medical equipment manufacturer.
## Custom Tooling: AI-Generated Reconnaissance Framework
### CHECKER2 (Go)
A Docker-based orchestrator for parallel VPN scanning and target processing. Logs showed processing of 2,516 targets across 106 countries in parallel batches. Each container follows the flow: ingest stolen VPN config → attempt connection → scan internal network → pass results to ARXON for LLM analysis.
### ARXON MCP Server (Python)
A custom Model Context Protocol (MCP) server — no public references found, likely purpose-built. ARXON serves dual roles:
1. **Analysis platform**: Ingests per-target recon data, calls DeepSeek to generate attack plans, stores results in a persistent knowledge base that grows with each target.
2. **Attack toolkit**: Contains scripts to directly modify victim infrastructure — batch SSH-based FortiGate VPN account creation, user provisioning, automated Domain Admin credential validation.
### AI-Generated Reconnaissance Tools (Go/Python)
Custom post-VPN reconnaissance tools with clear AI-generation indicators: redundant comments restating function names, simplistic architecture with disproportionate investment in formatting over functionality, naive JSON parsing via string matching rather than proper deserialization, compatibility shims for language built-ins with empty documentation stubs. The tools automate: ingesting target networks from VPN routing tables, classifying networks by size, running gogo port scanner for service discovery, identifying SMB hosts and domain controllers, and Nuclei vulnerability scanning against HTTP services.
## Post-Exploitation Metho
Weaknesses (CWE)
CWE-521, CWE-306, CWE-522, CWE-798
Target sectors: government, telecommunications, manufacturing, media, healthcare, managed-service-providers, enterprise, critical-infrastructure
Target regions: South Asia, Latin America, Caribbean, West Africa, Northern Europe, Southeast Asia, Turkey, South Korea, Egypt, Vietnam, Kenya, Asia-Pacific
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, CRITICAL, threat intelligence, cybersecurity, CVE-2019-7192, CVE-2023-27532, CVE-2024-40711, T1078.001, T1133, T1059.001, T1059.006, T1059.004, T1098, T1078, T1110.003, T1003.006, T1003.001