CyberStrikeAI servers tied to mass attacks on Fortinet FortiGate appliances

Team Cymru researchers say they found an open-source offensive tool, CyberStrikeAI, running on internet hosts that communicated directly with Fortinet FortiGate appliances targeted in a large campaign. The firm detected a CyberStrikeAI service banner on 212.11.64[.]250 listening on port 8080 and said NetFlow telemetry showed that address talking to FortiGate devices the attackers sought to exploit.

The CyberStrikeAI project is hosted publicly on GitHub under the alias Ed1s0nZ. The repository describes the code as an "AI-native security testing platform built in Go" and Team Cymru calls it an "open-source artificial intelligence (AI) offensive security tool (OST) developed by a China-based developer who we assess has some ties to the Chinese government." Team Cymru observed 21 unique IP addresses running instances of the platform between January 20 and February 26, 2026, and said the FortiGate campaign infrastructure was last seen running CyberStrikeAI on January 30.

Amazon Threat Intelligence provided complementary telemetry, reporting that an unknown attacker using AI-augmented services systematically targeted FortiGate devices and compromised more than 600 appliances in 55 countries. Team Cymru says its investigation was prompted in part by an IP address shared by that intelligence, and its Scout open port scans and NetFlow visibility are cited as the basis for the link between CyberStrikeAI hosts and FortiGate targets.

CyberStrikeAI bundles and orchestrates a broad library of offensive tooling. The project "integrates over 100 security tools … allowing it to conduct a full attack chain, including network scanning (nmap, masscan), web and application testing (sqlmap, nikto, gobuster), exploitation frameworks (metasploit, pwntools), password cracking tools (hashcat, john), and post-exploitation frameworks (mimikatz, bloodhound, impacket)." The platform also includes an orchestration engine, AI agents, a web dashboard and role-based "skills" that Team Cymru and others warn can lower the technical barrier for operators to run complex, automated campaigns.

The emergence of an AI-native orchestrator that exposes a centralized dashboard is significant because it can turn disparate exploits into an end-to-end service, reducing the expertise required to mount large-scale intrusions. Team Cymru urged caution, noting such engines "could accelerate automated targeting of exposed edge devices, including firewalls and VPN appliances."

Attribution remains unsettled in public reporting. Team Cymru's write-up emphasizes the developer's GitHub activity and prior sharing of the project with Knownsec 404's Starlink Project in December 2025, and it records a brief January 5 GitHub note claiming a CNNVD 2024 vulnerability award that later disappeared from the profile. Other collected summaries include a separate reference to an IP used by a "suspected Russian-speaking threat actor" conducting mass scans; that phrasing is not reconciled with Team Cymru's assessment and should be treated as reported but unverified.

The technical evidence Team Cymru published includes port banners, NetFlow visuals and commit history snapshots; the group recommends vendors and network operators examine appliance logs and NetFlow for connections to the listed IPs and monitor for signs of lateral movement. Fortinet has not been cited with a public confirmation in Team Cymru's post. Security teams should prioritize patching, restrict management-plane access, and review dashboards and management interfaces for unknown orchestration hosts.

Journalists and operators may review Team Cymru's figures and the CyberStrikeAI GitHub repository for further context; Team Cymru's analysis and Amazon CTI's account together underscore how AI-enabled orchestration can accelerate exploitation at internet scale.