DIVD first-party incident log: ARTEX agentic Zammad intrusion and data exfiltration

Evidence record

Dutch Institute for Vulnerability Disclosure public postmortem, updated October 31 with ARTEX identification and exact tool/side-effect observations.

Read the original source ↗

Claim-level citations (5)

• supportsDIVD traces a real Zammad intrusion to ARTEX agents, with root access and partial data exfiltration: DIVD confirms partial exfiltration of volunteer and help-desk data during the intrusion while noting that some more sensitive categories remain under investigation.

  Data overview and October 1 Update #5; incomplete categories and CVE environment statement

• supportsDIVD traces a real Zammad intrusion to ARTEX agents, with root access and partial data exfiltration: DIVD reports that an attacker combined two previously unknown Zammad flaws to reach root, with CVE-2026-102489 fixed in 7.2 and CVE-2026-102490 fixed in 7.2.2.

  Zammad vulnerabilities paragraph and Update #4 September 30

• supportsDIVD traces a real Zammad intrusion to ARTEX agents, with root access and partial data exfiltration: DIVD says the open-source ARTEX agentic penetration-testing framework was used during its September 2026 compromise, not merely suspected on the basis of script comments.

  Update #8, 31 October, Let us introduce you to ARTEX

• supportsDIVD traces a real Zammad intrusion to ARTEX agents, with root access and partial data exfiltration: DIVD describes over 450,000 attacker requests, more than 2,500 generated scripts and initial access to root within twelve minutes, while also noting loud errors and false starts.

  Update #8, 31 October, ARTEX sequential jobs, scripts and response timeline

• supportsDIVD traces a real Zammad intrusion to ARTEX agents, with root access and partial data exfiltration: DIVD says its attacker-side ARTEX logs show an agent created a non-expiring administrator API token, performed repeated internal mailbox access and scans, and continued extensive scripted activity before containment.

  Update #8, Let us introduce you to ARTEX, bullets: admin API token artex-i13033, mailbox accesses and internal scans