Fortinet FortiGate Devices Targeted by CyberStrikeAI, Allowing Hackers to Bypass Security

Threat intelligence researchers at Team Cymru have uncovered an open-source AI-powered offensive security tool called CyberStrikeAI, actively used to target Fortinet FortiGate devices at scale, with its developer carrying suspected ties to China’s Ministry of State Security (MSS).​

CyberStrikeAI is an AI-native security testing platform written in Go, developed by a GitHub user named Ed1s0nZ.

The tool integrates over 100 security tools with an intelligent orchestration engine, role-based testing capabilities, a specialized skills system, and full lifecycle management, all accessible through its own dashboard.

The repository was first published on November 8, 2025, but saw minimal usage initially.

Between January 20 and February 26, 2026, Team Cymru detected 21 unique IP addresses running CyberStrikeAI, a sharp operational spike that signals rapid adoption by threat actors.​

How It Targeted FortiGate Devices

The attack link was first flagged by Amazon Threat Intelligence, which shared a suspicious server IP, 212.11.64[.]250, associated with an AI-augmented campaign that compromised over 600 FortiGate devices across 55 countries between January 11 and February 18, 2026.

Team Cymru’s analysis of that IP using their Scout platform revealed a CyberStrikeAI service banner running on port 8080.

NetFlow data then confirmed direct network communications between that server and multiple Fortinet FortiGate appliances, confirming the tool’s active role in the campaign.

The FortiGate campaign infrastructure was last observed running CyberStrikeAI on January 30, 2026.

The attackers leveraged AI to generate step-by-step attack plans, command sequences, and exploitation methodologies.

No zero-day vulnerabilities were exploited; instead, the campaign relied on exposed management ports and weak single-factor authentication to gain access and harvest credentials.

Team Cymru’s investigation into Ed1s0nZ’s GitHub profile revealed a pattern of activity linked to Chinese state-sponsored operations. Key findings include:​

• On December 19, 2025, Ed1s0nZ submitted CyberStrikeAI to the Knownsec 404 Starlink Project, a firm with documented ties to the MSS and China’s People’s Liberation Army (PLA).​
• On January 5, 2026, Ed1s0nZ added a CNNVD (Chinese National Vulnerability Database) 2024 Level 2 Contribution Award to their GitHub profile. The CNNVD is overseen by the MSS and functions as a mechanism for the Chinese Communist Party to collect zero-days before public disclosure.​
• Ed1s0nZ later deleted the CNNVD reference from their GitHub profile, a move researchers interpret as an attempt to hide state affiliations as the tool gains popularity.​

The developer’s other repositories, PrivHunterAI (AI-driven privilege escalation detection) and InfiltrateX (automated privilege escalation scanning), further reinforce an exploitation-focused toolset.

​

Hosting Footprint & Defender Recommendations

Most CyberStrikeAI servers were hosted in China, Singapore, and Hong Kong, consistent with a Chinese-speaking developer base. Security teams should take immediate steps including:​

• Audit FortiGate appliances, disable management interfaces exposed to the internet
• Enforce multi-factor authentication across all network edge devices
• Monitor NetFlow and port scan data for CyberStrikeAI service banners (port 8080)
• Block indicator IP: 212.11.64[.]250 and associated infrastructure
• Harden backup infrastructure against credential-based lateral movement​

Team Cymru warns that as AI-native orchestration tools become more accessible, Chinese-speaking APT groups are likely to accelerate adoption of CyberStrikeAI, raising the risk of automated, large-scale exploitation of vulnerable edge devices globally.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

​