Chainstack Breach Exposes Customer Data and Password Hashes in AI-Powered ARTEX Campaign
Chainstack, a blockchain infrastructure provider, disclosed that an external attacker gained unauthorized access to its development environment on October 26, 2026, then escalated to parts of its production environment before being detected and cut off on October 31, 2026. The attacker accessed a database containing customer account information including organization names, account holder names, member email addresses, and password hashes, and had access to systems holding node credentials, which are being treated as exposed out of caution. The incident is assessed to overlap with a large-scale, AI-powered attack campaign using an autonomous agent framework called ARTEX, linked to a China-linked threat cluster, which has also hit WorkOS, Chainalysis, and the Dutch Institute for Vulnerability Disclosure (DIVD).
Detalhes técnicos
The attacker breached Chainstack via a third-party component, moving laterally from a development environment into production. Separately, WorkOS disclosed that the same ARTEX framework was used to compromise its GTM systems (not production or customer platform data), exposing business contact details, CRM account/relationship data, customer communication summaries (sales calls, support, Slack), and operational metadata. Chainalysis also detected agentic offensive activity and proactively took its Reactor and Data Solutions products offline on November 2, 2026. The DIVD breach on September 21, 2026, involved exploitation of two Zammad ticketing system zero-days, CVE-2026-102489 and CVE-2026-102490, enabling privilege escalation, remote code execution, and data exfiltration.
Remediação
Chainstack is advising customers to rotate node credentials, regenerate platform API keys, update passwords (especially reused ones across services), and remain alert for phishing attempts. WorkOS and Chainalysis are monitoring for further suspicious activity across affected systems.
Linha do tempo
-
Chainstack Breach Exposes Customer Data and Password Hashes in AI-Powered ARTEX Campaign
ler a análise desta fonte ocultar
Chainstack, a blockchain infrastructure provider, disclosed that an external attacker gained unauthorized access to its development environment on October 26, 2026, then escalated to parts of its production environment before being detected and cut off on October 31, 2026. The attacker accessed a database containing customer account information including organization names, account holder names, member email addresses, and password hashes, and had access to systems holding node credentials, which are being treated as exposed out of caution. The incident is assessed to overlap with a large-scale, AI-powered attack campaign using an autonomous agent framework called ARTEX, linked to a China-linked threat cluster, which has also hit WorkOS, Chainalysis, and the Dutch Institute for Vulnerability Disclosure (DIVD).
Technical Details
The attacker breached Chainstack via a third-party component, moving laterally from a development environment into production. Separately, WorkOS disclosed that the same ARTEX framework was used to compromise its GTM systems (not production or customer platform data), exposing business contact details, CRM account/relationship data, customer communication summaries (sales calls, support, Slack), and operational metadata. Chainalysis also detected agentic offensive activity and proactively took its Reactor and Data Solutions products offline on November 2, 2026. The DIVD breach on September 21, 2026, involved exploitation of two Zammad ticketing system zero-days, CVE-2026-102489 and CVE-2026-102490, enabling privilege escalation, remote code execution, and data exfiltration.
Remediation
Chainstack is advising customers to rotate node credentials, regenerate platform API keys, update passwords (especially reused ones across services), and remain alert for phishing attempts. WorkOS and Chainalysis are monitoring for further suspicious activity across affected systems.