A Russian-speaking, financially motivated threat actor has exploited commercial generative AI services to compromise over 600 FortiGate devices across 55 countries, as reported by Amazon Threat Intelligence. The activity occurred between January 11 and February 18, 2026, highlighting the growing use of AI in cyberattacks to enhance efficiency and scale.

This incident underscores the evolving threat landscape where AI tools are leveraged for malicious purposes, targeting critical infrastructure like FortiGate devices. It raises concerns about the security of AI services and the need for robust defenses against AI-assisted attacks in cybersecurity strategies.

Key Takeaways

  • Threat actor used commercial generative AI to compromise FortiGate devices
  • Over 600 devices affected across 55 countries
  • Activity observed from January 11 to February 18, 2026
  • Financially motivated and Russian-speaking actor involved
  • Highlights AI’s role in scaling cyberattacks

Threat Actors

Russian-speaking financially motivated threat actor

Source: The Hacker News