Researchers say a suspected China-linked group used AI-assisted tools to take over 25 firewalls and then went after a U.S. government-affiliated network's logins.
Attackers took full control of 25 firewall servers in the U.S., Japan, Taiwan and South Korea, and researchers say they used AI tools to build the attack. Three of the servers sat inside a U.S. government-affiliated network. The attackers then went after that network's login system. Security firm Dream disclosed the details, and the activity was seen on October 25, 2026.
A firewall is the gatekeeper between a company's network and the internet. The affected ones run one large vendor's software, and Dream did not name the vendor. Attackers reached each firewall's web management page, which is the screen admins use to configure it. They chained two sets of flaws, one in PHP, a common web programming tool, and one in the Linux operating system. That gave them root access, meaning complete control.
Dream found signs that the attacker used AI to speed up the work. Anthropic's Claude Code was installed on the attack setup. Keys for AI models from DeepSeek and Kimi were also there, tied to a tool called aiscan. Nearly 40 scripts shared a consistent code style that suggests AI help. Dream called the exploit a custom, non-public build made for this specific firewall.
The firewall was only the first step. After taking it over, the attacker targeted Active Directory, the system that holds staff accounts and passwords. Dream confirmed that logins were pulled out and the directory was mapped. It is not clear whether the attacker got valid passwords or created hidden accounts, so the full damage is unknown. Dream says the other 22 firewalls still have hidden back doors, called web shells, and a tunnel into the government network is likely still running.
The flaws were reportedly hard to use against real targets. One forum member called the PHP flaw unexploitable in practice, because attackers need details unique to each software build. This attacker got around that for one platform. Businesses that do not run the affected vendor's firewall, or whose admin page cannot be reached from the internet, face much less risk from this particular attack.
The alert box above lists the steps. The key idea is simple: do not leave a firewall's admin page open to the whole internet, and keep its software current. If a business does run a firewall like this, an IT provider should check it soon.
Dream says the attacker still has about 19,000 fingerprinted targets, which are devices already identified and cataloged, and may return as it studies other software versions. Dream notified the affected entity. The vendor's name and a full count of stolen logins have not been made public.
Do not leave your firewall's admin page open to the internet, and ask your IT provider to confirm it is locked down and updated.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
