By Lawrence Abrams
Publication Date: 2026-02-21 13:50:00
The article has been updated below with additional technical details about this campaign.
Amazon warns that a Russian-speaking hacker used multiple generative AI services as part of a campaign that breached more than 600 FortiGate firewalls in 55 countries in five weeks.
A new report from Amazon Integrated Security CISO CJ Moses says the hacking campaign took place between January 11 and February 18, 2026 and did not rely on exploits to break through Fortinet firewalls.
Instead, the threat actor targeted exposed management interfaces and weak credentials without MFA protection, then used AI to automate access to other devices on the attacked network.
According to Moses, the compromised firewalls were observed in South Asia, Latin America, the Caribbean, West Africa, Northern Europe and Southeast Asia, among others.
An AI-powered hacking campaign
Amazon says it learned about the campaign after finding a server hosting malicious tools…