What is CyberStrikeAI?

CyberStrikeAI is an open-source AI-native offensive security platform written in Go. It integrates over 100 security tools with an AI orchestration engine that accepts any OpenAI-compatible model (GPT, Claude, DeepSeek, etc.) and chains reconnaissance, exploitation, and post-exploitation into conversational commands via MCP (Model Context Protocol).

How many FortiGate devices were compromised?

Amazon Threat Intelligence confirmed over 600 FortiGate devices were compromised across more than 55 countries between January 11 and February 18, 2026. Separately, Cyber and Ramen reported that CHECKER2 logs showed 2,500+ devices queued for scanning across 100+ countries, though these were targets queued for access attempts, not confirmed compromises.

Who built CyberStrikeAI?

CyberStrikeAI was built by a developer using the GitHub handle Ed1s0nZ. Team Cymru linked Ed1s0nZ to Knownsec 404 (which DomainTools documented as having ties to China's MSS and PLA) and to CNNVD, the vulnerability database operated by the 13th Bureau of China's Ministry of State Security.

Did the FortiGate campaign use zero-day exploits?

No. According to Amazon's report, no zero-day vulnerabilities were exploited. The entire campaign succeeded by targeting exposed management ports (TCP 443, 8443, 10443, 4443) and weak credentials with single-factor authentication.

What is the connection between CyberStrikeAI and ARXON or CHECKER2?

ARXON and CHECKER2 are separate tools found on the same server (212.11.64.250) that also ran CyberStrikeAI. ARXON is a custom MCP server the campaign operator built to bridge LLMs with operational infrastructure. CHECKER2 is a Go-based Docker orchestrator for parallel VPN scanning. Both were documented by independent researcher blog Cyber and Ramen, not by Amazon or Team Cymru.

How can I protect my FortiGate devices?

Disable internet-exposed management interfaces immediately. Enforce multi-factor authentication on all admin accounts. Patch to FortiOS 7.6.2, 7.4.7, 7.2.11, 7.0.17, or 6.4.16 minimum. Disable SSL-VPN if not operationally required. Disable FortiCloud SSO if not actively needed. Check for symlinks in SSL-VPN language file directories.

What AI models does CyberStrikeAI support?

CyberStrikeAI's AI engine accepts any OpenAI-compatible API endpoint. The default configuration ships with DeepSeek (deepseek-chat). The repository also references GPT-4o in its Quick Start guide and lists Claude (claude-3-opus) as a supported model in config comments. Operators can swap between providers by changing config.yaml.

Is CyberStrikeAI still available?

As of March 2026, the CyberStrikeAI repository remains publicly available on GitHub under the Ed1s0nZ account. Team Cymru tracked 21 unique IPs running the platform between January 20 and February 26, 2026, with adoption accelerating.

One post tagged with "Cybersecurity"

CyberStrikeAI: the AI Attack Platform Behind the 600+ FortiGate Breach

March 4, 2026 · 27 min read

Dhayabaran V

Barrack AI

An open-source AI-powered offensive security platform, built by a developer with documented ties to China's Ministry of State Security, has been linked to a live campaign that compromised over 600 FortiGate devices across 55 countries in five weeks. Three separate investigations -- by Amazon Threat Intelligence, Team Cymru, and independent researcher blog Cyber and Ramen -- have collectively exposed how CyberStrikeAI and custom attacker-built tooling enabled a single, low-skilled operator to breach enterprise network infrastructure at industrial scale.