Google-owned researchers and independent intelligence teams have uncovered fresh details about an artificial intelligence driven campaign targeting Fortinet FortiGate devices worldwide. Investigators now confirm that the attackers relied on an open-source offensive platform known as CyberStrikeAI to automate and scale their operations.
AI Tool Identified in Mass Exploitation Campaign
Threat analysts at Team Cymru traced the infrastructure behind the campaign to the IP address 212.11.64[.]250, which was used to conduct automated scanning for vulnerable FortiGate appliances. Their investigation revealed that the attackers deployed CyberStrikeAI, an AI-native offensive security testing framework.
CyberStrikeAI is described as an open-source artificial intelligence driven offensive security tool developed by a China-based programmer operating under the alias Ed1s0nZ. According to researcher Will Thomas, also known online as @BushidoToken, the developer appears to maintain connections with entities linked to Chinese state security interests.
The broader campaign first came to light when Amazon Threat Intelligence reported systematic targeting of FortiGate appliances using generative AI services such as Anthropic Claude and DeepSeek. More than 600 devices across 55 countries were reportedly compromised.
What Is CyberStrikeAI
Based on information available in its public GitHub repository, CyberStrikeAI is written in Go and integrates over 100 security utilities. The framework supports vulnerability discovery, attack chain mapping, intelligence retrieval, and visualization of results.
Between January 20 and February 26, 2026, Team Cymru identified 21 distinct IP addresses operating CyberStrikeAI. Hosting locations were primarily concentrated in China, Singapore, and Hong Kong, with additional servers observed in the United States, Japan, and Switzerland.
Developer Activity Raises Questions
Beyond CyberStrikeAI, the Ed1s0nZ GitHub account hosts multiple tools associated with exploitation and AI model manipulation. These include ransomware projects, AI-powered privilege escalation scanners, and prompt collections aimed at bypassing safeguards in conversational AI systems.
Researchers observed that the developer had previously referenced receiving a Level 2 Contribution Award from the China National Vulnerability Database of Information Security, but those mentions were later removed from public documentation. Analysts believe this may signal an attempt to distance the project from potential state affiliations as scrutiny increases.
China operates two separate vulnerability databases, CNNVD and CNVD. CNNVD is overseen by the Ministry of State Security, while CNVD falls under CNCERT administration. Prior research has suggested differences in disclosure timelines based on severity scores.
Knownsec 404 and Broader State Links
Investigators also found interactions between the developer and Knownsec 404, a Chinese cybersecurity firm that experienced a significant internal data breach last year. The leak exposed thousands of internal documents, including materials allegedly tied to government clients and sensitive operational data.
In a January analysis, DomainTools characterized Knownsec as more than a conventional cybersecurity vendor, describing it as a state aligned cyber contractor with capabilities that extend into intelligence and strategic reconnaissance operations.
Global Impact and Security Concerns
Security experts warn that the rapid adoption of AI augmented offensive platforms like CyberStrikeAI signals a major shift in the threat landscape. By integrating automation, vulnerability scanning, and attack chain orchestration into a single toolkit, these platforms reduce the technical barrier for conducting large scale intrusions.
The campaign targeting FortiGate appliances demonstrates how generative AI and open-source offensive frameworks can be combined to identify and exploit vulnerable infrastructure at speed. Analysts expect similar AI assisted attack methodologies to expand across other enterprise technologies in the coming months.
Organizations are strongly advised to patch exposed FortiGate devices, monitor for unusual scanning activity, and implement strict access controls to reduce the risk of compromise.
Found this article interesting? Follow us on X (Twitter) , Facebook, Blue sky and LinkedIn to read more exclusive content we post.
