2026-02-20 · 2026-Q1
CyberStrikeAI FortiGate Mass Compromise
Outside the model: Offensive useAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Unknown
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
Fortinet FortiGate devices (600+ across 55 countries)
Impact
Russian-speaking financially motivated actor used commercial GenAI services and the open-source CyberStrikeAI framework to brute-force exposed management ports and single-factor credentials; Team Cymru observed 21 CyberStrikeAI C2 IPs between Jan 20 and Feb 26, 2026
Root cause
No FortiGate CVE exploitation; AI orchestration let a low-skill actor scale reconnaissance, credential spraying, and post-compromise steps against exposed admin interfaces
Sources
Catalog
Cite this: AgentProv incident record: CyberStrikeAI FortiGate Mass Compromise (2026-02-20). https://agentprov.com/incidents/2026-02-20-cyberstrikeai-fortigate-mass-compromise