AI Powered Attacks Are Hitting Firewalls

Source: Dev.to

AI‑Powered Attacks Are No Longer Theoretical

This week, Amazon’s security team published findings on a campaign that breached over 600 FortiGate firewalls across 55 countries in just five weeks. The attacker did not use zero‑day exploits. They leveraged:

• Brute‑force attacks against exposed management interfaces
• Weak credentials without MFA
• AI‑generated tooling to automate reconnaissance at scale

If you manage firewalls, VPNs, or any internet‑facing infrastructure, this is a wake‑up call worth paying attention to.

What Actually Happened

Timeframe: January – February 2026
Actor: Russian‑speaking threat actor

1. Scanning – The actor searched the Internet for FortiGate management interfaces that were exposed on the following ports:

   443, 8443, 10443, 4443

   These ports are commonly used for management and should never be publicly accessible without strict controls.

2. Opportunistic targeting – No specific industry was selected; the attacker simply looked for any exposed device and discovered hundreds of vulnerable instances.

3. Data exfiltration – After gaining access to a device, the attacker downloaded configuration files that contained:

   • SSL‑VPN user credentials (including recoverable passwords)
   • Administrative credentials
   • Firewall policies
   • Internal network architecture details
   • IPsec VPN configurations
   • Routing information

   In effect, the attacker obtained a complete blueprint of each victim’s network.

4. Analysis of the stolen tools – The extracted configurations were parsed with AI‑assisted Python and Go scripts. Amazon’s review of the source code identified classic hallmarks of AI‑generated code:

   • Redundant comments that merely restate function names
   • Over‑formatted but overly simplistic architecture
   • Naïve JSON parsing performed via string matching
   • Compatibility shims accompanied by empty documentation stubs

Why AI Changes the Threat Landscape

The tools themselves were not sophisticated. Amazon noted they often failed in hardened environments.

What matters is speed and scale:

• A single threat actor compromised 600 devices across 55 countries in five weeks.
• Without AI assistance, building custom reconnaissance tooling, configuration parsers, and automation scripts would have taken significantly longer.
• AI compressed the development cycle from weeks to hours.

Key takeaway: AI is not making attackers smarter—it is making them faster. The barrier to creating functional attack tooling has dropped dramatically, allowing a moderately skilled operator to produce exploits that previously required a dedicated team.

The Firewall Management Problem

The uncomfortable truth: most of these breaches were entirely preventable.
The attacker exploited exposed management interfaces and weak passwords without MFA—basic hygiene failures that have been on every security checklist for a decade.

Why do they persist?

• Legitimate exposure – remote administration, vendor‑support access, emergency troubleshooting.
• Temporary becomes permanent – once an exception is made, it often isn’t tracked or revoked.
• Scale – dozens of firewalls across multiple sites make disciplined processes essential, not just good intentions.

Common Exposure Patterns

Predictable ways management interfaces become exposed:

• Initial deployment shortcuts – Vendors or engineers enable remote access during setup and never disable it.
• Break‑glass access – Emergency remote‑management ports opened during incidents and then forgotten.
• Legacy configurations – Older devices are migrated without reviewing access controls.
• Shadow IT – Branch offices or departments deploy their own network equipment.
• Cloud migration gaps – Hybrid environments where on‑premises firewall management does not receive the same scrutiny as cloud security groups.

Each creates an attack surface that opportunistic scanners will find.

Practical Defence Measures

Defending against AI‑augmented attacks does not require AI‑powered defences. It requires doing the basics properly and consistently. Below are the priorities based on this campaign’s methodology.

Lock Down Management Interfaces

• Never expose management ports directly to the Internet.
• If remote management is required, place the interface behind a VPN or jump host with MFA.
• Run regular scans of your own external attack surface (e.g., Shodan, Censys, or internal nmap scans).
• Schedule these scans monthly at a minimum.

Enforce Strong Authentication

• Deploy MFA on every administrative interface.
• If your firewall vendor lacks MFA on the management plane, raise it as a serious concern—or consider alternative solutions.
• Apply password policies to network devices that match those for user accounts:
  • Unique, complex passwords
  • Regular rotation
  • Storage in a Privileged Access Management (PAM) system (avoid spreadsheets or shared documents).

Audit Configuration Extraction Risks

• Review firewall configurations for stored credentials (e.g., SSL‑VPN passwords).
• Understand how those credentials are protected.
• Fortinet’s guidance on credential storage in FortiOS recommends moving to certificate‑based authentication or integrating with external authentication servers (RADIUS, LDAP) that store credentials encrypted.

Segment and Monitor

Even if an … (the original text cuts off here; retain the existing content as provided).

Veeam Targeting – Lessons Learned

Attacker Tactics

• Compromised a firewall → proper network segmentation limits what they can reach.
• After initial access, the campaign specifically targeted Veeam Backup servers and Active Directory domain controllers – both high‑value assets that should reside in restricted network segments.

Monitoring Recommendations

• Watch for unusual activity from network devices: configuration exports, unexpected outbound connections, and changes to routing tables should all trigger alerts.
• Your SIEM must ingest firewall logs and correlate them with threat‑intelligence feeds.

Lessons From the Veeam Targeting

The focus on Veeam Backup & Replication servers deserves special attention. Backup infrastructure is increasingly targeted because ransomware operators know that destroying backups dramatically raises the likelihood of payment.

The attacker used custom PowerShell scripts and compiled credential‑extraction tools against Veeam servers. This pattern has accelerated throughout 2025 and into 2026.

If you run Veeam—or any backup solution—consider these actions:

• Isolate backup infrastructure – place it on a dedicated management VLAN with strict access controls.
• Use immutable backup targets – object storage with object lock or air‑gapped tape.
• Patch aggressively – Veeam vulnerabilities are actively exploited; treat patches as critical.
• Monitor backup job status – unexpected failures or configuration changes could indicate compromise.
• Test restores regularly – backups you cannot restore from are not backups.

Building an AI‑Era Security Posture

The scale of this campaign – 600 devices in five weeks – shows that manual security processes cannot keep pace with AI‑augmented attacks. IT leaders need to think about automation on the defensive side, too.

Automated Asset Discovery

“You cannot protect what you do not know about.”

Continuous asset discovery and attack‑surface monitoring should run automatically. Commercial tools like Qualys, Tenable, or open‑source alternatives such as OpenVAS can continuously scan your perimeter.

Configuration‑Compliance Monitoring

• Every firewall must be checked against a defined baseline configuration automatically.
• Any deviation—especially new management‑access rules or changed authentication settings—should trigger an immediate alert.

Threat‑Intelligence Integration

This campaign was identified partly because Amazon found the attacker’s infrastructure. Consuming threat‑intelligence feeds and correlating Indicators of Compromise (IoCs) against your network telemetry is essential.

• At a minimum, feed published IoCs into your firewall block lists and SIEM correlation rules.

What IT Leaders Should Do This Week

If this campaign has your attention, here are five actions you can take immediately:

1. Audit external exposure – scan your perimeter for any management interfaces on ports 443, 8443, 10443, and 4443.
2. Verify MFA everywhere – confirm that every administrative interface requires multi‑factor authentication.
3. Review firewall credential storage – check whether your devices store credentials in recoverable formats.
4. Check backup isolation – ensure backup infrastructure sits on restricted network segments with separate credentials.
5. Brief your team – share Amazon’s report with your security and infrastructure teams so everyone understands the current threat.

None of these are expensive. None require new tooling. They require attention and discipline – which is exactly what separates organisations that get breached from those that do not.

The AI‑augmented attacker is here. The good news is that the defences are not mysterious. They are the same fundamentals we have always known matter. The difference now is that the cost of getting them wrong has gone up dramatically.