Between 11 January and 18 February 2026, a single threat actor breached more than 600 FortiGate firewalls across 55 countries. Amazon, which documented the campaign, assessed the attacker as having a low-to-medium skill set.
No CVE was involved. No exploit was used. The method was to scan for FortiGate management interfaces exposed on ports 443, 8443, 10443 and 4443, then brute-force common passwords against interfaces that lacked multi-factor authentication.
What made it a 600-device campaign rather than a hobby was automation. The attacker drove several large language models through a custom Model Context Protocol server to generate methodology, build reconnaissance tooling in Python and Go, plan lateral movement and run offensive tools.
What actually happened
| Element | Detail |
|---|---|
| Vulnerability exploited | None |
| Method | Scan exposed management interfaces, brute-force weak credentials |
| Ports scanned | 443, 8443, 10443, 4443 |
| MFA on affected devices | Absent |
| Targeting | Opportunistic, across industries |
| Result | 600+ firewalls, 55 countries, five weeks |
Amazon's framing was that generative AI acts as a multiplier, letting attackers scale intrusions more efficiently. That is the right conclusion, and it is worth being precise about what was multiplied. Not the discovery of a novel weakness. The tedium of working through a very long list of devices that would answer.
The gap: a management interface is a service that answers strangers
Every device in this campaign had a management interface reachable from the internet. That is not usually a decision anybody made deliberately. It accumulates: a device provisioned in a hurry, a remote administrator who needed access one weekend, a managed service provider's requirement, a rule that was temporary in 2021.
Once it is reachable, it appears in scan results, and scan results are how this campaign chose targets.
The attacker did not need to know anything about any of these 600 organizations. The only qualification for the target list was answering a connection.
The absent MFA is the failure that gets cited, and it is real. But note the order of events. Brute force requires a login prompt. A login prompt requires the device to answer. MFA raises the cost of guessing; it does not remove the prompt or the device's willingness to present it to anyone who asks.
There is a second-order point worth making about AI here. Commentary on this campaign focused on whether AI creates new attacks. In this case it plainly did not. What it did was make an attacker's effort roughly independent of the number of targets, and that changes the economics of exposure. An interface that was previously too low-value to be worth anybody's afternoon is now worth an automated pass.
What would have had to be true
For this campaign to fail against a given device, the scan would have had to come back with nothing.
Restricting a management interface to a known set of source networks is not an exotic control. It is the first recommendation in every hardening guide for every one of these devices. The reason it is so unevenly applied is the same as always: administrators move, providers change, and the list of "known" networks goes stale faster than anybody can maintain it, so it gets widened until it stops being a control or dropped as too much trouble.
Where Veribound would have fitted
Veribound informs; the customer's own edge enforces. Nothing here replaces the firewall, the credentials, or MFA.
An agent on each administrator's device keeps confirming it is still the one the organization trusted. What reaches the FortiGate is a trusted origin: the network that device is connecting from, in practice its public address. Those arrive as address-group updates against the management access rule the device already has, the rule the 600 breached firewalls had left open to the internet.
Applied here:
- The scan returns nothing, so the device never reaches the target list.
- Weak passwords stay weak and there is no prompt to try them against.
- The AI tooling is unaffected and irrelevant, because it automates work against devices that answer.
What it would not have done: it does not improve the passwords, it does not substitute for MFA on the management interface, and it does nothing about an administrator whose own trusted device is compromised. It removes the device from the population of things a stranger can attempt anything against.
The lesson most often drawn from this campaign is that AI is making attackers more capable. The more useful one is that a five-week campaign against 600 organizations began with a port scan, and a port scan only works on things that reply.
Source: Amazon: AI-assisted hacker breached 600 Fortinet firewalls in 5 weeks, BleepingComputer, 21 February 2026.