LLMS IN THE KILL CHAIN: INSIDE A CUSTOM MCP TARGETING FORTIGATE DEVICES ACROSS CONTINENTS

Summary from the TLDR InfoSec newsletter

A misconfigured server exposed a full intrusion toolkit where a threat actor integrated LLMs directly into the attack workflow — using DeepSeek to generate attack plans from recon data and Claude Code to conduct live vulnerability assessments — while targeting FortiGate appliances across 106 countries with 2,516 identified targets. Custom tools ARXON (an MCP server bridging LLM analysis with attack scripts) and CHECKER2 (a Go-based Docker orchestrator) automated the pipeline from stolen VPN config ingestion through internal scanning to LLM-driven exploitation planning, evolving from the open-source HexStrike framework in roughly eight weeks. Defenders should audit for unauthorized VPN accounts, unexpected SSH access, and unapproved firewall policy changes, as the dual-model approach of selecting whichever LLM is most permissive for a given task lowers the skill barrier for managing concurrent intrusions at scale.