Zammad Zero-Day Exploits Power AI-Driven DIVD Attack

A recent security breach confirmed that attackers combined multiple zero‑day vulnerabilities in the open‑source help‑desk platform Zammad to hijack user sessions, execute remote code and gain root privileges. The exploit was used in an AI‑powered operation dubbed DIVD, according to a report published by SecurityWeek.

The attack targets organizations that run Zammad on their internal networks or host it publicly. By chaining the flaws, the threat actors were able to bypass authentication, inject malicious commands and ultimately take full control of the affected servers. The compromised systems can then be used to launch further attacks, steal data or serve as a foothold for ransomware groups.

Zammad is popular among small to medium‑size businesses for ticket management, making the breach relevant to many enterprises that may not have dedicated security teams. The exploit chain works by first stealing session cookies, then leveraging a remote code execution flaw to run arbitrary commands, and finally escalating privileges to the root user, which gives unrestricted access to the operating system.

Users of Zammad should immediately apply any patches released by the project maintainers and verify that their installations are up to date. Disabling unnecessary modules, tightening firewall rules to limit inbound traffic to trusted IP ranges, and monitoring logs for unusual login activity can help detect an ongoing compromise. Password security remains essential; enforce strong, unique passwords and enable multi‑factor authentication wherever possible.

For those unsure whether their Zammad instance has been affected, free scanning tools available at ComputerScams.com can check for known indicators of compromise. Running a full system audit, updating all software components, and backing up critical data to an offline location are prudent steps to limit damage.

The incident underscores the growing use of artificial intelligence to automate complex exploit chains, raising the bar for attackers and defenders alike. Staying vigilant, applying updates promptly, and following basic cyber security tips are the most effective ways to reduce risk.

Protect yourself online by regularly reviewing account activity and changing passwords if you notice anything unusual.

Source: Read the original report