Earlier this year, a hacker compromised 600 firewalls in 55 countries over just five weeks. A master hacker, you say? Nope. Instead of drumming up some zero-days or writing clever malware, they chained together a series of familiar attack techniques, using AI to make each step faster and more scalable.
The attack campaign was noticed by Amazon after they found a server hosting the malicious tools. The attacks seemed to exclusively target Fortinet FortiGate firewalls.
So what happened, and more importantly, what can an enterprise do to make sure they’re not next? The problem wasn’t the firewalls themselves. It was how they were configured and deployed without the defensive measures they need to do their job.
To explore this, let’s look at how the attacker breached defenses, one by one, with relatively simple hacking tools. This also gives us the opportunity to look at how to strengthen our own defenses with a good MDR (Managed Detection and Response) system.
And because we like a good analogy, let’s take a look at the attack from the perspective of a medieval castle with its own firewall, moat, and guard.
The castle walls make a great firewall. Inside your castle is all your company’s sensitive data including finances, customer details, employee records, and trade secrets. And, to complete the picture, coming down the road to the castle is an intruder carrying a bag of tricks.
With the idea that every successful attack is also a sequence of missed defensive opportunities, let’s see how the castle does in defending against the attacker.
Attack Phase 1: Locating the targets
Most of the traffic to and from the castle goes through the drawbridge door, things like API requests and normal internet traffic from the castle’s staff. But there’s one major exception: the system administrator. They get into the castle via a small rowboat that they row around to the back to a guarded access door. (If you look closely at the first picture, you’ll see our little sysadmin rowboat tucked away behind a tree.)
The rowboat is the management interface, which includes the sysadmin login. Only the system administrator should ever use it.
The attacker started by scanning the Internet for FortiGate firewalls, specifically firewalls with an attack surface that went beyond the drawbridge door. In other words, he looked for castles where the rowboat was not hidden at all and was just sitting there, exposed, bobbing in the breeze.
And with access to the management interface, the attacker reached his first objective.
Remedy
Reduce the attack surface. The sysadmin rowboat should be “hidden in the trees” by VPN access, or at least strong MFA. The attacker was able to find at least 600 castles where the rowboat was sitting in plain sight, with no one stopping him from climbing in.
Attack Phase 2: Guessing the password
Once the management interface was found, the attacker just needed to row around to the back of the castle to the secret security door. But then he encountered another obstacle: a guard who demanded the sysadmin password to authenticate the attacker before he would let him in.
Sadly, this guard wasn’t very well-trained. His only instructions were to let in the guy in the rowboat if he had the password. Nobody told him what to do if he didn’t recognize the guy, or if the guy was from another country, or if the man in the rowboat had to make multiple tries before getting it right.
On top of that, the password itself wasn’t terribly complicated, and the attacker used AI to accelerate the password-guessing game. And so the attacker got right in the door.
Remedy
Authentication monitoring would point up important questions about access attempts like this. Why is this administrator failing authentication dozens of times? Why are those attempts coming from outside the country, and why at 3 AM? And of course, better passwords that can’t be guessed by an AI bot would help.
Attack Phase 3: Grabbing the keys
Once he got inside the castle walls, the attacker grabbed and exported firewall configuration files. No one questioned why the firewall administrator suddenly needed to export the castle’s master key ring.
The attacker then extracted VPN credentials and administrative information from the configuration files to expand his access to various rooms in the castle.
Remedy
Monitoring of administrative activity would have caught this abnormal activity and triggered an alert.
Attack Phase 4: Mapping the layout
With VPN credentials now in hand, the attacker was able to start exploring and formulate a map of the castle’s interior with the goal of finding the most valuable targets, again using AI to accelerate the process.
The attacker queried Active Directory, poked around for more VPN credentials, and performed searches to try and find backups. If some part of the system was too hardened to attack, they just moved on to look for softer targets. This is where the AI acceleration really came in handy.
And once again, the castle guards snoozed while the attacker mapped out every nook and cranny of the castle.
Remedy
A robust monitoring system would have picked up on such activity. Why is a firewall administrator suddenly querying Active Directory? Why is a VPN account touching file servers it has never accessed before?
Attack Phase 5: Crippling the backups
For a company, recent backups are one of the key pieces of a ransomware response plan, one that enables them to bounce back without paying the ransom. If an attacker can destroy or lock up backups, their own chances for success go way up.
Amazon noted in their report that the focus on backups appeared to foreshadow a ransomware attack. Fortunately, Amazon observed and disrupted the campaign before this phase got into full swing.
Remedy
Strong monitoring of access to backup infrastructure is a good practice as part of any cybersecurity plan, not just ransomware preparedness.
Is AI the culprit?
None of these techniques are new. Scanning the internet, guessing passwords, exporting configurations, and moving laterally around networks are classic hacker moves. What’s different about this attack is the speed at which it was carried out due to AI assistance and acceleration. AI made it possible for a relatively inexperienced attacker to automate searches, generate scripts, and pivot quickly to softer targets if needed.
The campaign demonstrated that AI doesn’t need to invent new attacks to make existing ones more dangerous. It only needs to make them cheaper and faster.
Opportunities for MDR
The lesson from this campaign isn’t that AI suddenly made hackers unstoppable. It’s that every step the attacker took generated opportunities for defenders to notice something wasn’t right:
| Attacker action | Defender opportunity |
| Scanning for exposed management interfaces | Reduce external attack surface |
| Repeated authentication attempts | MFA and authentication monitoring |
| Configuration export | Alert on unusual administrative actions |
| Use of stolen VPN credentials | Identity and behavioral analytics |
| Lateral movement | Detect abnormal access patterns |
| Backup discovery | Monitor privileged access to recovery infrastructure |
| Ransomware staging | Early containment before encryption |
Could your castle stand up to this attack? If you’re not sure, it may be time to strengthen your own security posture with a strong MDR plan.
