Amazon says Russian-speaking hacker used AI to hit one of world’s most deployed network firewalls in 5 weeks

Amazon Threat Intelligence has revealed that a single “unsophisticated” attacker has compromised more than 600 organisations across 55 countries in just over a month. According to the company’s findings, the campaign ran from January 11 to February 18, 2026, and targeted FortiGate firewalls – some of the most common security devices used by businesses worldwide. The hacker didn’t use any complex “zero-day” exploits or secret software flaws. Instead, they used commercial AI tools to automate the “grunt work” of cybercrime.

“This investigation highlights how commercial AI services can lower the technical barrier to entry for offensive cyber capabilities. The threat actor in this campaign is not known to be associated with any advanced persistent threat group with state-sponsored resources.