Russian Cyber Threat Actor Uses GenAI to Compromise Fortinet Firewalls
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-7192 | Unauthenticated Improper Access Control in QNAP Photo Station CVE-2019-7192 is a critical improper access control flaw (CWE-863) in QNAP Photo Station, the web-based photo application that runs on QNAP QTS NAS devices. Because the flaw is reachable over the network without credentials or user interaction (CVSS 3.1 9.8), remote attackers can gain unauthorized access to vulnerable systems. A public proof of concept demonstrates chaining the bug into remote command execution on Photo Station 6.0.3 under QTS, giving attackers the ability to execute commands on the NAS. Any QNAP NAS running an outdated Photo Station, particularly when its web interface is exposed to untrusted networks, is affected. Exploitation is confirmed in the wild: CISA added it to the KEV on 2022-06-08 with known ransomware use, and EPSS assigns a 88.2% probability of exploitation in the next 30 days (top percentile). Do: Update Photo Station to the latest version per QNAP's security advisory, and verify the installed Photo Station version on every QTS NAS. Where updating is not immediately possible, disable Photo Station or restrict its web endpoints to trusted networks, and check devices for signs of compromise given the known ransomware exploitation. | 9.8 | 88% | KEV ransomware PoC |
| largetens of thousands of internet-exposed QNAP NAS running Photo Station (public scan counts) | |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials Veeam Backup & Replication (VBR) contains a missing-authentication flaw (CWE-306) in its Cloud Connect component that lets an unauthenticated network attacker obtain encrypted credentials stored in VBR's configuration database. It is triggered simply by connecting to the exposed service, because the function that serves credential material performs no authentication check; no privileges or user interaction are required (CVSS 3.1: 7.5, network vector). With the recovered credentials, an attacker can gain access to backup infrastructure hosts, which has been used as an entry point and pivot for ransomware operations. Any organization running Veeam Backup & Replication is potentially affected, with the greatest risk where the VBR/Cloud Connect service is reachable from the internet. Exploitation is confirmed: CISA added the bug to its KEV catalog on 2023-08-22 with known ransomware use, the Cuba ransomware group has been observed stealing credentials through this exploit, and EPSS assigns a 77.6% near-term exploitation probability (100th percentile). Do: Apply the fixes Veeam provides in its security advisory immediately — per CISA's KEV listing, patch per vendor instructions or discontinue use — prioritizing internet-facing Cloud Connect servers. After patching, rotate all credentials stored in the configuration database, since they should be considered exposed, and review those accounts for signs of misuse. Restrict network access to the VBR service from untrusted networks and check servers for exploitation indicators such as unexpected connections to the service or anomalous logins with stored credentials. | 7.5 | 78% | KEV ransomware |
| largetens of thousands of deployments, of which thousands are internet-exposed (estimate) | |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication Veeam Backup & Replication contains a deserialization of untrusted data flaw (CWE-502) that allows an unauthenticated attacker to send a maliciously crafted serialized payload to the product's network-facing service and achieve remote code execution, with no privileges or user interaction required (CVSS 3.1: 9.8). Successful exploitation yields full code execution on the backup server with high impact on confidentiality, integrity and availability, and is especially valuable to attackers because backup infrastructure typically stores credentials and ransomware operators seek to destroy or encrypt backups before attacking production systems. Any organization running Veeam Backup & Replication is in scope; the provided data does not specify exact affected version ranges, so consult Veeam's advisory for the affected/fixed builds. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-10-17 with known ransomware use, a public proof-of-concept has been published by watchTowr, EPSS estimates a 90.4% probability of exploitation within 30 days (100th percentile), and the exploit has been reused in Frag ransomware attacks. Do: Apply Veeam's security updates immediately (the vendor released fixes for 18 flaws, including 5 critical ones); per the KEV required action, apply mitigations per Veeam's instructions or discontinue use if mitigations are unavailable. Until patched, restrict network access to the backup server from untrusted networks and remove unnecessary internet exposure. Given confirmed ransomware exploitation, also hunt for signs of compromise on backup servers and review backup job integrity and stored credentials. | 9.8 | 90% | KEV ransomware PoC |
| mass≈ hundreds of thousands of on-prem backup server deployments plausibly affected (tens of thousands internet-exposed) |
Full article767 words · extracted from infosecurity-magazine.com · click to collapse
A low-skilled cyber threat actor has been observed leveraging several generative AI (GenAI) tools to deploy a malicious campaign aimed at compromising Fortinet’s FortiGate firewall appliances.
In an Amazon Web Services (AWS) Security blog published on February 20, CJ Moses, CISO of Amazon Integrated Security, shared findings about the campaign.
Amazon Threat Intelligence assessed that the attacker was a Russian-speaking, financially motivated threat actor with limited technical capabilities.
The threat actor used multiple commercial GenAI services to implement and scale well-known attack techniques throughout every phase of their operation.
AWS assessed the campaign ran from January 11 to February 18, 2026, and compromised over 600 FortiGate devices across more than 55 countries.
Amazon Threat Intelligence noted that AWS infrastructure was not involved in this campaign and that no exploitation of FortiGate vulnerabilities was observed.
FortiGate Compromise: Attack Workflow Explained
This campaign was deemed opportunistic rather than targeted.
The threat actor scanned FortiGate management interfaces exposed to the internet and tried gaining access to them using commonly reused credentials.
They developed AI-assisted Python scripts to parse, decrypt and organize these stolen configurations.
Once VPN access to victim networks was gained, the threat actor deployed a custom reconnaissance tool, also likely developed with the use of AI services, with different versions written in both Go and Python.
Indicators of AI involvement in this tool included redundant comments that merely restate function names, simplistic architecture with disproportionate investment in formatting over functionality, naive JSON parsing via string matching rather than proper deserialization and compatibility shims for language built-ins with empty documentation stubs.
“While functional for the threat actor’s specific use case, the tooling lacks robustness and fails under edge cases – characteristics typical of AI-generated code used without significant refinement,” Moses noted.
The post-VPN reconnaissance access tool workflow performed tasks such as ingesting target networks from VPN routing tables, classifying networks by size, running service discovery using gogo, an open-source port scanner, automatically identifying SMB hosts and domain controllers and integrating vulnerability scanning using Nuclei, an open-source vulnerability scanner, against discovered HTTP services to produce prioritized target lists.
Once inside victim networks, the threat actor followed a standard approach leveraging well-known open-source offensive tools, including:
- Domain compromise using Meterpreter, an open-source post-exploitation toolkit, with the Mimikatz module to perform DCSync attacks against domain controllers, allowing the actor to extract NTLM password hashes from Active Directory
- Lateral movement by attempting to expand access through pass-the-hash/pass-the-ticket attacks against additional infrastructure, NTLM relay attacks using standard poisoning tools and remote command execution on Windows hosts
- Backup infrastructure targeting by deploying multiple tools for extracting credentials, including PowerShell scripts, compiled decryption tools and exploitation attempts leveraging known vulnerabilities in Veeam Backup & Replication servers
- Limited exploitation success (e.g. CVE-2019-7192, CVE-2023-27532, CVE-2024-40711)
“However, a critical finding from this analysis is that the threat actor largely failed when attempting to exploit anything beyond the most straightforward, automated attack paths. Their own documentation records repeated failures: targeted services were patched, required ports were closed, vulnerabilities didn’t apply to the target OS versions,” Moses wrote.
Threat Actor’s Multifaceted Use of GenAI
The Amazon Threat Intelligence analysis revealed that the actor used at least two distinct commercial large language model (LLM) providers throughout their operations.
It used AI for multiple tasks, including:
- Attack planning: generate comprehensive attack methodologies complete with step-by-step exploitation instructions, expected success rates, time estimates and prioritized task trees
- Multi-model operational workflow: for instance, one model served as the primary tool developer, attack planner, and operational assistant, while a second is used as a supplementary attack planner when the actor needs help pivoting within a specific compromised network
- Compromise planning tool: in one observed instance, the actor submitted the complete internal topology of an active victim (IP addresses, hostnames, confirmed credentials, and identified services) and requested a step-by-step plan to compromise additional systems they could not access with their existing tools
- Infrastructure building: beyond the reconnaissance framework, the actor’s infrastructure contains numerous scripts in multiple programming languages bearing hallmarks of AI generation, including configuration parsers, credential extraction tools, VPN connection automation, mass scanning orchestration and result aggregation dashboards
Amazon Threat Intelligence said it expects cybercriminals with low-to-medium skill levels to continue leveraging commercial AI tools for malicious purposes in 2026.
“Strong defensive fundamentals remain the most effective countermeasure: patch management for perimeter devices, credential hygiene, network segmentation and robust detection for post-exploitation indicators,” outlined Moses.
The AWS Security blog also provided defenders with a long list of mitigation recommendations built around four pillars: FortiGate appliance audit, credential hygiene, post-exploitation detection and backup infrastructure hardening.
Read now: Low-Skilled Cybercriminals Use AI to Perform "Vibe Extortion" Attacks
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/russian-threat-actor-genai/