Agentic Attackers and FortiBleed: The SOC Squeeze Gets Tighter

Week of 12 October 2026 | Compiled by Team Paringa

This week showed attackers using agentic AI to run intrusions faster, while a credential-driven Fortinet campaign keeps feeding ransomware crews. Both raise the bar for SOC and MSSP response times.

What Happened This Week

🔴 CrowdStrike unpicks an AI-assisted attack on South Korean banks

CrowdStrike analyst Ashley Campion published findings on 7 October on attacks against South Korean financial institutions. The Korea Times names at least five lenders: Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank and BNK Busan Bank. Reported customer impact was about 25,000 at Shinhan, 119 at KB Kookmin and 89 at Hana. One intrusion hit a loan progress inquiry service, another a mobile work-support system.

The notable part is the tooling. The attacker paired Claude Code with ARTEX, a recently released open-source penetration-testing tool developed in China. CrowdStrike says the activity shows a financially motivated actor using agentic AI alongside traditional offensive capability to run several intrusions in a short period. The attacker also had Claude Code sessions probing a Telegram-based NFT gift marketplace.

The attacker's operational security was poor. Exposed AI session histories, configuration files and memory files documented the targeting, and a Chinese-language instruction file led investigators to a second server in Hong Kong. CrowdStrike says it expects adversaries to keep experimenting with AI tooling to raise tempo. Korean lawmakers have approved summoning the heads of five major banks to an audit on 19 October.

Sources: The Register

The lesson is not that AI makes attackers magic. It compresses the time between recon and impact, so detection and triage windows shrink. If your SOC or MSSP still measures success in hours to investigate, you are being benchmarked against an adversary working in minutes. Ask your provider for current mean time to detect and respond figures, and whether playbooks automate containment or only raise tickets. This is the week to test that.

🔴 FBI and Secret Service: FortiBleed credentials are locking firewall owners out

A joint FBI and US Secret Service advisory on 6 October says criminals using credentials tied to the FortiBleed campaign are locking organisations out of their own Fortinet firewalls. SOCRadar has verified more than 86,644 compromised devices across 194 countries. The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways using credentials from earlier breaches and infostealer logs, through stuffing and spraying. Attackers also pull password hashes from devices and crack them offline on GPU clusters.

Once inside, actors create new accounts, and sometimes delete existing ones, which blocks the victim and maintains persistence. Initial access brokers are selling this access on. Current evidence points to INC/Lynx and Payload ransomware affiliates, and SOCRadar said in July it had seen at least 12 confirmed ransomware attacks from FortiBleed. Industrial Cyber reports the FBI and Secret Service are urging critical infrastructure operators to secure their Fortinet gateways.

Recommended actions include restricting internet-facing management, terminating active admin and VPN sessions, resetting passwords and enabling phishing-resistant MFA.

Sources: The Register, Industrial Cyber

Perimeter devices are the front door and the logs are often nobody's job. Confirm that firewall admin and VPN authentication events reach your SIEM, that you alert on new local accounts and password changes, and that someone owns the response at 2am. An MSSP that only watches endpoints would have missed the early stage of this. Put it on the next service review agenda.

🟡 Agent platforms are the new soft target

Zenity Labs researchers showed that an attacker with only chat access to an exposed agent on Amazon Bedrock AgentCore could prompt it to fetch its instance metadata and hand over temporary IAM credentials. Those credentials could launch agents, read sessions, write agent memories and fetch secrets from AWS Secrets Manager. AgentCore moved to IMDSv2 only on 14 February, and Zenity's final review on 29 September found the remaining permission issues addressed. Amazon says exploitation would require developer error.

Separately, The Register reported that the Shai-Hulud npm worm jumped to AI infrastructure through a Tensorlake compromise, and that hidden web page instructions could push GitHub Copilot CLI into leaking secrets.

Sources: The Register, The Register

Clients are deploying agents faster than they are threat modelling them. Add AI agents and their service identities to your asset inventory and your detection scope now, because few SOCs have a use case for agent misuse today.

What Security Teams Are Dealing With

Teams are squeezed from two sides. Attackers are using agentic tooling to move quicker, and the most damaging campaign this week, FortiBleed, relies on old stolen credentials rather than clever exploits. That means the work is unglamorous: log coverage on edge devices, fast account and session revocation, and clear ownership of after-hours response.

Palo Alto's latest report, covered by Industrial Cyber, points to legacy OT systems and fragmented security tools as drags on resilience. Tool sprawl makes it harder for a SOC to correlate the very signals that matter this week. Consolidation and a clear escalation path with your MSSP are worth more than another dashboard.

Three Things Worth Watching Next Week

1. Korean bank audit on 19 October — Lawmakers will question five bank heads. Expect detail on how the intrusions were detected and what regulators will now require.

2. FortiBleed ransomware attribution — Watch for further INC/Lynx and Payload victim disclosures and any updated indicators of compromise from the FBI.

3. Agentic tooling in attacker playbooks — More vendor reporting on AI-assisted intrusions is likely after the CrowdStrike findings. Check your detection coverage against it.

Questions? hello@paringa.ai

Paringa helps channel partners and their customers turn threat news into practical security decisions. We focus on what to ask your provider, and what to fix first. | 12 October 2026 | © Paringa Ltd