The Dutch Institute for Vulnerability Disclosure (DIVD) dates malicious entry to 21 September 2026 through two then-unknown vulnerabilities in its Zammad ticketing service. The security group published a detailed timeline and, on October 31, identified the ARTEX agentic penetration-testing framework from its incident evidence. This goes beyond superficial…
Inspect the ClaimsCase · DiggingBeagle record
DIVD traces a real Zammad intrusion to ARTEX agents, with root access and partial data exfiltration
DIVD links a September 2026 Zammad intrusion to ARTEX agentic pentest tooling, documenting rapid root escalation, excessive request volume and partial exfiltration.
Scope
Live victim incident and first-party forensic updates, September 21 to October 31. AI-agent framework identity asserted from victim logs; specific model and full autonomy not disclosed.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- WITH AI
Basis and provenance
Victim directly reports the Zammad exploitation chain, use of ARTEX, root escalation, partial exfiltration and detailed attacker log artifacts. DIVD and vendor advisories describe patched versions and configuration limitations; recovery of all leaked materials and independent full actor/model attribution remain unknown.
Assessed Nov 5, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DIVD-ARTEX-CONFIRMED · CLM-DIVD-TWO-ZERODAYS · CLM-DIVD-ARTEX-TELEMETRY · CLM-DIVD-PERSISTENT-API-TOKEN · DIVD first-party incident log: ARTEX agentic Zammad intrusion and data exfiltration
At a glance
DIVD's first-party logs connect ARTEX job identifiers, repeated scripts and a persistent administrative token to a real compromised environment. Those traces are stronger evidence of framework participation than model names alone, but they cannot establish every model prompt or independently directed step. The initial Zammad access path, subsequent…
Read the implicationsPrecise operator identity, model weights/provider and full tool-by-tool transcript are not yet publicly released. Exact categories, recipients and volume of all exfiltrated data remain under investigation. Victim did not attribute unrelated incidents involving ARTEX to the same actor.
Limits and uncertaintyFull account
The Dutch Institute for Vulnerability Disclosure (DIVD) dates malicious entry to 21 September 2026 through two then-unknown vulnerabilities in its Zammad ticketing service. The security group published a detailed timeline and, on October 31, identified the ARTEX agentic penetration-testing framework from its incident evidence. This goes beyond superficial observations that attacker scripts used AI-style comments: the responder describes ARTEX job numbers and tool effects, including persistent administrative tokens and automated internal network activity.
DIVD reports more than 450,000 requests and more than 2,500 scripts during the intrusion, with a twelve-minute route from initial access to root through two Zammad flaws. High-volume activity did not mean stealth or consistent correctness. DIVD describes agent mistakes, a noisy attack and partial data exfiltration. It separately says some categories are still being investigated and that its CVE/CNA environment has no indication of access.
This is a single September incident with successive September and October updates, not several separate cases for each public disclosure. The AI component is an attacker-operated agentic penetration-testing framework, while the executable vulnerabilities are Zammad session hijacking/RCE and local escalation. Neither the model used by the attacker nor a complete public trace is established. DIVD says ARTEX was also discussed in other attacks, but explicitly warns that this does not establish a shared actor or campaign across those targets. The event provides unusually concrete victim-side operational evidence for autonomous cyber operations, in contrast to the many model-only demonstrations.
The internal event log is unusually specific about the tool boundary. DIVD says it identified small ARTEX jobs with ordered identifiers, including creation of an administrator API token with no expiry. The activity included repeated mailbox access, test messages, internal scans, password-reset attempts and retrieval of database login tokens. More than 450,000 requests and 2,500 scripts were logged, but the noise included self-interference and unsuccessful actions. DIVD measures twelve minutes from initial access to root in its environment; this is one compromised organization, not an expected speed for every exposed Zammad installation. The vendor and DIVD vulnerability advisories distinguish a remote route exploitable on certain older Zammad runtime configurations from a separate local escalation affecting packaged installs. DIVD explicitly declines to attribute other reported ARTEX campaigns to the same person. The malicious agent framework is a capability, not an attacker identity.
Mechanism and trust boundary
- 01
Exploit Zammad helpdesk entry point
Two previously unknown flaws allowed remote session access/code execution and local elevation.
Boundary: External requests into helpdesk service and then privileged host
- 02
Run ARTEX-generated penetration-test jobs
Attacker automation enumerated systems, generated scripts and tested additional access paths.
Boundary: Agent plans into executable commands using stolen credentials
- 03
Create persistence and obtain records
Victim reports a no-expiry admin API token and access to volunteer and helpdesk information.
Boundary: Compromised helpdesk rights into broader internal records
- 04
Incident response stops further intrusion
DIVD detected malicious activity and shut down or rebuilt affected infrastructure.
Boundary: Intruder runtime versus network segmentation and incident-response controls
Claims & evidence
CLM-DIVD-DATA-LEAKDIVD confirms partial exfiltration of volunteer and help-desk data during the intrusion while noting that some more sensitive categories remain under investigation.supported
Basis: reported finding
- supportsDIVD first-party incident log: ARTEX agentic Zammad intrusion and data exfiltrationprimary disclosure
Data overview and October 1 Update #5; incomplete categories and CVE environment statement
CLM-DIVD-TWO-ZERODAYSDIVD reports that an attacker combined two previously unknown Zammad flaws to reach root, with CVE-2026-102489 fixed in 7.2 and CVE-2026-102490 fixed in 7.2.2.supported
Basis: reported finding
- supportsDIVD first-party incident log: ARTEX agentic Zammad intrusion and data exfiltrationprimary disclosure
Zammad vulnerabilities paragraph and Update #4 September 30
CLM-DIVD-ARTEX-CONFIRMEDDIVD says the open-source ARTEX agentic penetration-testing framework was used during its September 2026 compromise, not merely suspected on the basis of script comments.supported
Basis: reported finding
- supportsDIVD first-party incident log: ARTEX agentic Zammad intrusion and data exfiltrationprimary disclosure
Update #8, 31 October, Let us introduce you to ARTEX
CLM-DIVD-ARTEX-TELEMETRYDIVD describes over 450,000 attacker requests, more than 2,500 generated scripts and initial access to root within twelve minutes, while also noting loud errors and false starts.supported
Basis: reported finding
- supportsDIVD first-party incident log: ARTEX agentic Zammad intrusion and data exfiltrationprimary disclosure
Update #8, 31 October, ARTEX sequential jobs, scripts and response timeline
CLM-DIVD-PERSISTENT-API-TOKENDIVD says its attacker-side ARTEX logs show an agent created a non-expiring administrator API token, performed repeated internal mailbox access and scans, and continued extensive scripted activity before containment.supported
Basis: reported finding
- supportsDIVD first-party incident log: ARTEX agentic Zammad intrusion and data exfiltrationprimary disclosure
Update #8, Let us introduce you to ARTEX, bullets: admin API token artex-i13033, mailbox accesses and internal scans
Implications
DIVD's first-party logs connect ARTEX job identifiers, repeated scripts and a persistent administrative token to a real compromised environment. Those traces are stronger evidence of framework participation than model names alone, but they cannot establish every model prompt or independently directed step. The initial Zammad access path, subsequent privilege escalation and data extraction require separate evidence and remediation controls: patching vulnerable software does not erase an already stolen token or retrieve copied files. Keep the ARTEX entity as a reusable software identity while assigning victim, operator and attribution only to this Case where supported. DIVD warns against assuming other ARTEX appearances share the same threat actor. Investigation value lies in timestamps, actual executor actions and observed data movement, not the raw count of noisy requests.
Controls and mitigations
- Apply Zammad fixes, especially the affected 7.2 and 7.2.2 repair lines, and audit sessions, API tokens and local elevation traces.
- Use per-service permissions and network segmentation so a compromised helpdesk cannot directly reach high-value credential stores.
- Correlate AI-agent generated job labels and actual command receipts; do not infer exploit success from explanatory script comments alone.
- Apply current Zammad fixes for the relevant installation and packaging method; restrict service-account writable files from privileged startup paths, revoke persistent API tokens and correlate short-lived agent job identifiers with server access and authentication logs. Neither updating one remote bug nor banning an AI client alone resolves a preexisting local escalation or stolen credentials.
Unknowns and contradictions
- Precise operator identity, model weights/provider and full tool-by-tool transcript are not yet publicly released.
- Exact categories, recipients and volume of all exfiltrated data remain under investigation.
- Victim did not attribute unrelated incidents involving ARTEX to the same actor.
Sources and citation
Material revision history
- Nov 5, 2026 · Published version · first publication · revision 221