Source: Dev.to

AI‑Powered Attacks Are No Longer Theoretical

This week, Amazon’s security team published findings on a campaign that breached over 600 FortiGate firewalls across 55 countries in just five weeks. The attacker did not use zero‑day exploits. They leveraged:

• Brute‑force attacks against exposed management interfaces
• Weak credentials without MFA
• AI‑generated tooling to automate reconnaissance at scale

If you manage firewalls, VPNs, or any internet‑facing infrastructure, this is a wake‑up call worth paying attention to.

---

What Actually Happened

Timeframe: January – February 2026
Actor: Russian‑speaking threat actor

1. The actor scanned the internet for FortiGate management interfaces exposed on the following ports:

   443, 8443, 10443, 4443

   These are common management ports that should never be publicly accessible without strict controls.

2. The attack was opportunistic—no specific industry was targeted. The actor simply looked for weak points and found hundreds of them.

3. Once inside a device, the attacker extracted configuration files containing:

   • SSL‑VPN user credentials (with recoverable passwords)
   • Administrative credentials
   • Firewall policies
   • Internal network architecture details
   • IPsec VPN configurations
   • Routing information

   In short, a complete blueprint of the victim’s network.

4. The stolen configurations were parsed with AI‑assisted Python and Go tools. Amazon’s analysis of the source code revealed classic signs of AI‑generated code:

   • Redundant comments restating function names
   • Over‑formatted but simplistic architecture
   • Naïve JSON parsing via string matching
   • Compatibility shims with empty documentation stubs

---

Why AI Changes the Threat Landscape

The tools themselves were not sophisticated. Amazon noted they often failed in hardened environments.
What matters is speed and scale:

• A single threat actor compromised 600 devices across 55 countries in five weeks.
• Without AI assistance, building custom reconnaissance tooling, configuration parsers, and automation scripts would have taken significantly longer.
• AI compressed the development cycle from weeks to hours.

Key takeaway: AI is not making attackers smarter—it is making them faster. The barrier to creating functional attack tooling has dropped dramatically, allowing a moderately skilled operator to produce exploits that previously required a dedicated team.

---

The Firewall Management Problem

The uncomfortable truth: most of these breaches were entirely preventable. The attacker exploited exposed management interfaces and weak passwords without MFA—basic hygiene failures that have been on every security checklist for a decade.

Why do they persist?

• Legitimate exposure – remote administration, vendor support access, emergency troubleshooting.
• Temporary becomes permanent – once an exception is made, it often isn’t tracked or revoked.
• Scale – dozens of firewalls across multiple sites make disciplined processes essential, not just good intentions.

---

Common Exposure Patterns

Predictable ways management interfaces become exposed:

• Initial deployment shortcuts – vendors or engineers enable remote access during setup and never disable it.
• Break‑glass access – emergency remote‑management ports opened during incidents and forgotten.
• Legacy configurations – older devices migrated without reviewing access controls.
• Shadow IT – branch offices or departments deploying their own network equipment.
• Cloud migration gaps – hybrid environments where on‑premises firewall management does not receive the same scrutiny as cloud security groups.

Each creates attack surface that opportunistic scanners will find.

---

Practical Defence Measures

Defending against AI‑augmented attacks does not require AI‑powered defences. It requires doing the basics properly and consistently. Below are the priorities based on this campaign’s methodology.

Lock Down Management Interfaces

• Never expose management ports directly to the internet.
• If remote management is required, place the interface behind a VPN or jump host with MFA.
• Run regular scans of your own external attack surface (e.g., Shodan, Censys, or internal nmap scans).
• Schedule these scans monthly at a minimum.

Enforce Strong Authentication

• Deploy MFA on every administrative interface.
• If your firewall vendor lacks MFA on the management plane, raise it as a serious concern—or consider alternative solutions.
• Apply password policies to network devices that match those for user accounts:
  • Unique, complex passwords
  • Regular rotation
  • Storage in a Privileged Access Management (PAM) system (avoid spreadsheets or shared documents).

Audit Configuration Extraction Risks

• Review firewall configurations for stored credentials (e.g., SSL‑VPN passwords).
• Understand how those credentials are protected.
• Fortinet’s guidance on credential storage in FortiOS recommends moving to certificate‑based authentication or integrating with external authentication servers (RADIUS, LDAP) that store credentials encrypted.

Segment and Monitor

Even if an … (the original text cuts off here; retain the existing content as provided).

# Veeam Targeting – Lessons Learned

**Attacker Tactics**  
- Compromised a firewall → proper network segmentation limits what they can reach.  
- After initial access, the campaign specifically targeted **Veeam Backup servers** and **Active Directory domain controllers** – both high‑value assets that should reside in restricted network segments.

**Monitoring Recommendations**  
- Watch for unusual activity from network devices: configuration exports, unexpected outbound connections, and changes to routing tables should all trigger alerts.  
- Your SIEM must ingest firewall logs and correlate them with threat‑intelligence feeds.

---

## Lessons From the Veeam Targeting

The focus on **Veeam Backup & Replication** servers deserves special attention. Backup infrastructure is increasingly targeted because ransomware operators know that destroying backups dramatically raises the likelihood of payment.

The attacker used custom PowerShell scripts and compiled credential‑extraction tools against Veeam servers. This pattern has accelerated throughout 2025 and into 2026.

### If you run Veeam or any backup solution:

- **Isolate backup infrastructure** – place it on a dedicated management VLAN with strict access controls.  
- **Use immutable backup targets** – object storage with object lock or air‑gapped tape.  
- **Patch aggressively** – Veeam vulnerabilities are actively exploited; treat patches as critical.  
- **Monitor backup job status** – unexpected failures or configuration changes could indicate compromise.  
- **Test restores regularly** – backups you cannot restore from are not backups.

---

## Building an AI‑Era Security Posture

The scale of this campaign – **600 devices in five weeks** – shows that manual security processes cannot keep pace with AI‑augmented attacks. IT leaders need to think about automation on the defensive side too.

### Automated Asset Discovery

> “You cannot protect what you do not know about.”  
Continuous asset discovery and attack‑surface monitoring should run automatically. Commercial tools like **Qualys**, **Tenable**, or open‑source alternatives such as **OpenVAS** can continuously scan your perimeter.

### Configuration‑Compliance Monitoring

- Every firewall should be checked against a defined baseline configuration automatically.  
- Deviations – especially new management‑access rules or changed authentication settings – must generate immediate alerts.

### Threat‑Intelligence Integration

This campaign was identified partly because **Amazon** found the attacker’s infrastructure. Consuming threat‑intelligence feeds and correlating Indicators of Compromise (IoCs) against your network telemetry is essential.

- At minimum, feed published IoCs into your firewall block lists and SIEM correlation rules.

---

## What IT Leaders Should Do This Week

If this campaign has your attention, here are **five actions you can take immediately**:

1. **Audit external exposure** – scan your perimeter for any management interfaces on ports **443, 8443, 10443, and 4443**.  
2. **Verify MFA everywhere** – confirm that every administrative interface requires multi‑factor authentication.  
3. **Review firewall credential storage** – check whether your devices store credentials in recoverable formats.  
4. **Check backup isolation** – ensure backup infrastructure sits on restricted network segments with separate credentials.  
5. **Brief your team** – share Amazon’s report with your security and infrastructure teams so everyone understands the current threat.

> None of these are expensive. None require new tooling. They require attention and discipline – which is exactly what separates organisations that get breached from those that do not.

The AI‑augmented attacker is here. The good news is that the defences are not mysterious. They are the same fundamentals we have always known matter. The difference now is that the cost of getting them wrong has gone up dramatically.