Dutch Cybersecurity Non-Profit Hit by AI-Driven Attack Exploiting Zammad Zero-Days

The Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer-run organisation that ethically reports security flaws, has disclosed that it was itself compromised after noticing suspicious activity on 24 September. The attackers exploited two zero-day vulnerabilities in the Zammad helpdesk platform, a remote code execution bug and a privilege escalation flaw, which when chained together carried a CVSS severity score of 9.4.

DIVD said the combined flaws allowed attackers to hijack sessions, run code remotely and escalate from a standard Zammad user to full root access within seconds, enabling them to access other services and exfiltrate data. Volunteer data, including email addresses and possibly contact details, was compromised, raising the risk of impersonation attempts against DIVD staff. The organisation credited its network segmentation and rapid incident response for preventing deeper intrusion, though it confirmed some damage had already occurred.

Investigators found evidence that the attack was carried out using agentic AI: logs reportedly showed the attacker's automated scripts including notes justifying its own actions as not being phishing, a behaviour unusual for a human operator. DIVD is urging all organisations running Zammad to update to version 7 immediately or take affected systems offline until patched.