Researchers from Amazon Threat Intelligence have reported that a Russian-speaking threat actor used generative AI services to breach over 600 FortiGate firewalls across fifty-five (55) countries within five (5) weeks, from January 11 to February 18, 2026. The campaign exploited exposed management interfaces and weak credentials lacking MFA protection, bypassing the need for zero-day exploits. The compromised firewalls were found globally, including in South Asia, Latin America, and Northern Europe. The threat actor employed AI-powered tools to automate network access, reconnaissance, and lateral movement within breached systems. These tools, written in Python and Go, demonstrated AI-assisted development, with simplistic architecture and redundant coding characteristics typical of AI-generated code. The campaign targeted Veeam Backup and Replication servers and attempted to exploit various known Veeam vulnerabilities, including CVE-2019-7192 and CVE-2023-27532. Amazon’s findings suggest the threat actor had limited technical capabilities but significantly amplified their operations through AI, utilizing large language models (LLMs) to generate attack methodologies and reconnaissance frameworks. This approach lowered the barrier to entry for cybercrime, enabling extensive network compromises. Separate research by Cyber and Ramen highlighted the use of AI models like DeepSeek and Claude to generate attack plans. A custom Model Context Protocol (MCP) server named ARXON was used to bridge reconnaissance data with language models, automating post-compromise analysis and attack planning. The campaign’s integration of AI demonstrates how unsophisticated actors can scale operations efficiently, a highly forecasted threat for 2026. CTIX Analysts recommend securing FortiGate management interfaces, enabling MFA, and isolating backup servers. Organizations should also anticipate continued AI-augmented threat activity and prioritize stronger defensive measures such as patch management and credential hygiene. CTIX Analysts will continue providing updates on emerging AI tactics being used by Threat Actors.