Breached through two Zammad zero-days (CVE-2026-102489, 102490). Exfiltration of volunteer user data is confirmed, and several systems show signs of partial exfiltration. No signs were seen for HR, source code, Slack or finance.
Confirmed victims
- DIVD
Attribution
- ARTEX basis
- DIVD confirmed use of ARTEX in Update #8 (Oct 31). Job labels contain strings such as artex-i13033. Earlier notices mentioned only an autonomous AI agent.
- Actor
- DIVD: does not publish attacker information.
- Same attacker?
- DIVD says ARTEX appearing in other news does not mean those attacks are related.
Figures and definitions
| Scale | 450,000+ requests; 2,500+ scripts |
|---|---|
| Speed | Initial access to root: seconds (Update #4, BleepingComputer); 12 minutes (Update #8) |
| Detection | Detected in 19 minutes; versus intrusion on Sep 21 and detection on Sep 22 |
Sources (5)
- 2026-09-24 Victim DIVD CSIRT Overview of data investigation (DIVD-2026-00014)
- 持续更新 (Updat Victim DIVD We got hacked, here's everything we know
- 2026-09-29 Media BleepingComputer Automated AI agent used to breach cybersecurity nonprofit DIVD
- 2026-09-30 Media BleepingComputer DIVD says Zammad zero-days enabled AI-driven network breach
- 未标 (页面只显示 6 Media DIVD Let us introduce you to ARTEX (DIVD LinkedIn post)