## Overview

On February 21, 2026, Amazon Integrated Security (CJ Moses, CISO) published research documenting a Russian-speaking threat actor who compromised 600+ FortiGate firewall appliances across 55+ countries in just 5 weeks (January 11 — February 18, 2026). The campaign was independently corroborated by Cyber and Ramen (Hunt.io research) and reported by BleepingComputer.

This campaign is significant not for sophisticated exploitation — no zero-days were used — but for demonstrating how commercial AI services enable low-to-medium skill actors to achieve nation-state-scale operations. The actor used at least two commercial LLM providers (DeepSeek and Anthropic Claude) throughout every phase of the kill chain: tool development, attack planning, reconnaissance automation, credential extraction, lateral movement planning, and operational documentation.

## Initial Access: Mass Credential Abuse

The actor's initial access was brute-force attacks against FortiGate management interfaces exposed to the internet. Systematic scanning targeted ports 443, 8443, 10443, and 4443, followed by authentication attempts using commonly reused credentials. No FortiGate vulnerabilities were exploited for initial access — the campaign succeeded entirely through exposed management ports and weak/single-factor credentials.

FortiGate configuration files were high-value targets containing: SSL-VPN user credentials with recoverable passwords, administrative credentials, complete network topology and routing information, firewall policies revealing internal architecture, and IPsec VPN peer configurations. The actor developed AI-assisted Python scripts to parse, decrypt, and organize stolen configurations.

## Geographic Distribution

The campaign's targeting was opportunistic rather than sector-specific, consistent with automated mass scanning. Concentrations of compromised devices were observed across South Asia, Latin America, the Caribbean, West Africa, Northern Europe, and Southeast Asia. Patterns of contiguous IP blocks and shared non-standard management ports indicated MSP deployments and large organizational networks.

Confirmed compromises included an industrial gas company in Asia-Pacific, a telecom provider in Turkey, and a major media company in Asia. Additional reconnaissance referenced targets in South Korea, Egypt, Vietnam, Kenya, and a medical equipment manufacturer.

## Custom Tooling: AI-Generated Reconnaissance Framework

### CHECKER2 (Go)

A Docker-based orchestrator for parallel VPN scanning and target processing. Logs showed processing of 2,516 targets across 106 countries in parallel batches. Each container follows the flow: ingest stolen VPN config → attempt connection → scan internal network → pass results to ARXON for LLM analysis.

### ARXON MCP Server (Python)

A custom Model Context Protocol (MCP) server — no public references found, likely purpose-built. ARXON serves dual roles: 1. **Analysis platform**: Ingests per-target recon data, calls DeepSeek to generate attack plans, stores results in a persistent knowledge base that grows with each target. 2. **Attack toolkit**: Contains scripts to directly modify victim infrastructure — batch SSH-based FortiGate VPN account creation, user provisioning, automated Domain Admin credential validation.

### AI-Generated Reconnaissance Tools (Go/Python)

Custom post-VPN reconnaissance tools with clear AI-generation indicators: redundant comments restating function names, simplistic architecture with disproportionate investment in formatting over functionality, naive JSON parsing via string matching rather than proper deserialization, compatibility shims for language built-ins with empty documentation stubs. The tools automate: ingesting target networks from VPN routing tables, classifying networks by size, running gogo port scanner for service discovery, identifying SMB hosts and domain controllers, and Nuclei vulnerability scanning against HTTP services.

## Post-Exploitation Methodology

### Domain Compromise Operational documentation (in Russian) detailed the use of Meterpreter with the mimikatz module to perform DCSync attacks against domain controllers, extracting NTLM password hashes from Active Directory. In confirmed compromises, the attacker obtained complete domain credential databases. In at least one case, the Domain Administrator used a plaintext password extracted from FortiGate configuration through password reuse.

### Lateral Movement Following domain compromise: pass-the-hash and pass-the-ticket attacks against additional infrastructure, NTLM relay attacks using standard poisoning tools (ntlmrelayx.py from Impacket), and remote command execution on Windows hosts.

### Backup Infrastructure Targeting The actor specifically targeted Veeam Backup & Replication servers using DecryptVeeamPasswords.ps1 (PowerShell credential extraction), compiled decryption tools, and exploitation attempts leveraging CVE-2023-27532 (Veeam information disclosure) and CVE-2024-40711 (Veeam RCE). This is a classic pre-ransomware indicator — destroying backup infrastructure before encryption.

### Limited Exploitation Success A critical finding: the actor largely failed when attempting to exploit anything beyond straightforward automated attack paths. Their own documentation records repeated failures against patched services, closed ports, and non-matching OS versions. When encountering hardened environments, they simply moved on to softer targets.

## AI as Force Multiplier

### Multi-Model Operational Workflow - **DeepSeek**: Used for generating structured attack plans from reconnaissance data, target triage, and tactical analysis. - **Claude/Claude Code**: Used for vulnerability assessments during live intrusions, tool development, attack planning, and was configured to autonomously execute offensive tools (Impacket, Metasploit, hashcat) without human approval per command. - At least two distinct commercial LLM providers used in complementary roles.

### AI-Generated Attack Planning AI generated comprehensive attack methodologies with step-by-step exploitation instructions, expected success rates, time estimates, and prioritized task trees. Plans referenced academic research on offensive AI agents. The AI produced technically accurate command sequences, but the actor struggled to adapt when conditions differed from the plan.

### Operational Evolution The operation evolved over 8+ weeks: - **December 2025**: Used HexStrike (open-source offensive MCP framework). Claude Code pre-approved to execute Impacket, Metasploit, hashcat with hardcoded victim credentials. - **February 2026**: Graduated to custom ARXON MCP server — fully automated exploitation system with persistent knowledge base.

## Staging Infrastructure

The misconfigured staging server at 212.11.64.250:9999 (AS4264, Global-Data System IT Corporation, Zurich, Switzerland) exposed 1,402 files across 139 subdirectories, including: - Stolen FortiGate configuration backups - Active Directory mapping data (BloodHound collection data) - Credential dumps and NTLM hashes - Vulnerability assessment reports (Claude Code-generated) - CVE exploit code - Nuclei scanning templates - Veeam credential extraction tools - claude-0/ and claude/ directories with 200+ files (task outputs, session diffs, cached prompt states) - ARXON MCP server source code - CHECKER2 orchestrator - deploy_output.log showing 102MB archive of FortiGate configs organized by country - Russian-language operational documentation

A second staging server at 185.196.11.225 (Kali Linux) was used for automated scanning, receiving the 102MB config archive and launching parallel processing.

## Threat Actor Assessment (Amazon)

- **Motivation**: Financially motivated (pre-ransomware TTPs) - **Language**: Russian-speaking (operational documentation in Russian) - **Skill Level**: Low-to-medium baseline, significantly augmented by AI - **AI Dependency**: Extensive — all operational phases - **Operational Scale**: 600+ devices, 55+ countries, 5 weeks - **Post-Exploitation Depth**: Shallow — fails against hardened targets, moves on - **Operational Security**: Inadequate — unencrypted staging server with victim data

## Remediation

### Immediate Actions - Audit all FortiGate management interface exposure — disable internet-facing management ports - Enable MFA on all FortiGate administrative and VPN accounts - Rotate all SSL-VPN and administrative credentials on FortiGate devices - Check for unauthorized VPN accounts created via SSH (ARXON capability) - Review FortiGate configuration backups for signs of extraction - Audit Active Directory for DCSync indicators and NTLM relay artifacts

### Long-Term Defenses - Network segmentation — isolate management interfaces from internet - Implement certificate-based VPN authentication - Deploy Veeam backup hardening (immutable backups, MFA) - Monitor for AI-generated tooling patterns in endpoint logs - Audit SSH sessions to FortiGate appliances for bulk modifications - Deploy detection for CHECKER2/ARXON tool artifacts