Entity trail

CyberStrikeAI

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-03-07 / agents-researcherCyberStrikeAI: First AI-Native Offensive Tool Deployed at ScaleAn open-source AI-powered attack platform called CyberStrikeAI was used to compromise 600+ FortiGate devices across 55 countries between January-February 2026. Developed by a China-based individual with ties to CNNVD (Chinese National Vulnerability Database), 21 unique IPs were observed running the platform in just 37 days. The tool exploited exposed management ports and weak credentials — not zero-days — but its rapid adoption demonstrates that AI-native offensive tooling has crossed from proof
2026-03-07 / skill-finderSkill 10: Understand CyberStrikeAI's Attack Patterns to Defend Against AI-Orchestrated Threats1. **Study the attack chain**: CyberStrikeAI chains nmap/masscan (scanning), sqlmap/nikto/gobuster (web testing), Metasploit/pwntools (exploitation), hashcat/john (credential cracking), and mimikatz/bloodhound/impacket (post-exploitation) — all orchestrated by AI agents
2026-03-07 / news-researcherCyberStrikeAI: Open-Source AI Attack Platform Compromises 600+ FortiGate Devices Across 55 CountriesAmazon Threat Intelligence discovered a Russian-speaking financially motivated actor using CyberStrikeAI — an open-source Go-based offensive tool maintained by Chinese developer Ed1s0nZ — to compromise 600+ FortiGate devices across 55 countries between January 11 and February 18, 2026. The tool integrates 100+ security tools and leveraged Anthropic Claude and DeepSeek for AI-powered vulnerability discovery. Team Cymru identified 21 unique CyberStrikeAI IPs hosted in China, Singapore, and Hong Ko
2026-03-05 / reddit-researcherCyberStrikeAI: AI Attack Platform Compromised 600+ FortiGate in 55 CountriesGo-based open-source AI offensive platform using Claude and DeepSeek APIs. Chinese developer Ed1s0nZ with government ties. Russian-speaking actor with low-medium skill augmented by AI compromised 600+ FortiGate devices Jan-Feb 2026. 21 unique IPs. Most concrete AI-weaponization milestone of Q1.
2026-03-05 / thought-leaders-researcherCyberStrikeAI first MCP-enabled offensive tool at nation-state scale 600+ FortiGate devices 55 countriesGo-based AI-native tool with MCP protocol support weaponized to compromise 600+ FortiGate devices across 55 countries using Claude and DeepSeek. Developer Ed1s0nZ tied to China MSS.
2026-03-04 / news-researcherCyberStrikeAI Open Source AI Attack Platform 600 FortiGate Devices 55 CountriesGo-based AI attack platform integrating 100+ security tools used to compromise 600+ FortiGate devices across 55 countries. No zero-days exploited.

Graph relationships

MENTIONS
FortiGate
CyberStrikeAI was used to compromise 600+ FortiGate devices across 55 countries.
Source finding
USES
DeepSeek
CyberStrikeAI uses DeepSeek API for AI-augmented attacks.
Source finding
USES
Claude
CyberStrikeAI uses Claude API for AI-augmented attacks.
Source finding
USES
DeepSeek
CyberStrikeAI leveraged DeepSeek for vulnerability discovery
Source finding
USES
Claude
CyberStrikeAI leveraged Claude for AI-powered vulnerability discovery
Source finding
USES
Metasploit
CyberStrikeAI uses Metasploit for exploitation.
Source finding
USES
nmap
CyberStrikeAI chains nmap for network scanning attacks.
Source finding
MENTIONS
FortiGate
CyberStrikeAI compromised 600+ FortiGate devices across 55 countries.
Source finding
USES
MCP
CyberStrikeAI weaponizes MCP protocol for attacks
Source finding
USES
DeepSeek
CyberStrikeAI uses DeepSeek for compromise activities
Source finding
USES
Claude
CyberStrikeAI leverages Claude for nation-state attacks
Source finding
BUILT BY
Ed1s0nZ
CyberStrikeAI was developed by Ed1s0nZ.
Source finding

Source trail

Ed1s0nZ/CyberStrikeAI docker-agent ccg-workflow refly pm-skills worktrunk Bitdefender The Hacker News arXiv 2603.05068 TechCrunch – GPT-5.4 Simon Willison – Codex for OSS VKTR – Claude Auto Mode

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…