Blokcheyn infratuzilma provayderi Chainstack seshanba kuni o'z infratuzilmasining ba'zi qismlariga ruxsatsiz kirish imkonini bergan kiberhujum nishoni bo'lganini ma'lum qildi.
Hodisa o'tgan hafta ma'lum bo'lgan keng ko'lamli, sun'iy intellekt (SI) quvvatlangan hujum kampaniyasining bir qismi deb baholanmoqda.
"Tashqi hujumchi uchinchi tomon komponenti orqali Chainstack infratuzilmasining bir qismiga ruxsatsiz kirish huquqini qo'lga kiritdi," deb aytdi kompaniya. "Biz kirishni aniqladik, kirish yo'llarini kesdik va tizimlarimizni mustahkamlayapmiz."
Chainstack tomonidan e'lon qilingan voqealar xronologiyasiga ko'ra, hujumchi 2026-yil 26-oktabrda ishlab chiqarish muhitiga kirish huquqini qo'lga kiritgan va keyin o'z kirish huquqini kengaytirib, "ishlab chiqarish muhitimizning ba'zi qismlariga" kirib olgan.
Kompaniya ta'kidlashicha, kirish 2026-yil 31-oktabrda aniqlangan va hujumchining kirish huquqi o'sha kuni kesib qo'yilgan.
Raqamli buzilish doirasida tahdid aktori mijoz hisob ma'lumotlarini, jumladan tashkilot nomlari, hisob egalarining ismlari, Chainstackdagi tashkilot a'zolarining elektron pochta manzillari va parol xeshlarini o'z ichiga olgan ma'lumotlar bazasiga kirish huquqini qo'lga kiritgan deb aytilmoqda.
"Hujumchi shuningdek, tugun ma'lumotlarini saqlovchi tizimlarga ham kirish huquqiga ega bo'lgan," deb aytdi Chainstack. "Ular o'qilganiga dalil yo'q, lekin biz ularni fosh etilgan deb hisoblaymiz va mijozlardan ularni aylantirishni so'raymiz."
Tugun ma'lumotlarini aylantirishdan tashqari, mijozlarga platforma API kalitlarini qayta yaratish, parollarni yangilash — shu jumladan bir xil parol qayta ishlatilgan boshqa xizmatlarda ham — va potentsial fishing urinishlariga nisbatan hushyor bo'lish tavsiya etiladi.
Chainstack hujum haqida hech qanday tafsilotlarni oshkor qilmagan bo'lsa-da, bu Xitoy bilan bog'liq klaster tomonidan yuqori qiymatli firmalarni ARTEX yordamida nishonga olish kampaniyasi bilan o'xshashliklarga ega deb baholanmoqda.
WorkOS ham ARTEX tomonidan nishonga olingan
Bu voqea API platformasi WorkOS ham xuddi shu avtonom SI agent tizimidan foydalanib hujum operatsiyalarini amalga oshirish bilan bog'liq xavfsizlik hodisasini e'lon qilgan paytga to'g'ri keladi. 2026-yil 30-oktabrda aniqlangan hodisa GTM tizimlari bilan cheklangan va ishlab chiqarish tizimlari yoki mijoz platformasi ma'lumotlariga ta'sir qilmagan.
Kirish huquqi qo'lga kiritilgan ma'lumotlar quyidagilarni o'z ichiga oladi:
- Biznes aloqa ma'lumotlari (Mijozlar bilan munosabatlarni boshqarish tizimida saqlanadigan ismlar, elektron pochta manzillari, telefon raqamlari, lavozim unvonlari va kompaniya a'zoliklari)
- Biznes hisob va munosabat ma'lumotlari (Mijoz hisob tarixi va savdo hamda mijozlar bilan munosabatlar haqidagi ma'lumotlar)
- Mijoz aloqalari (Savdo qo'ng'iroqlari, qo'llab-quvvatlash muhokamalari va mijoz Slack suhbatlaridan xulosalar va parchalar)
- Operatsion metama'lumotlar (Mijozlarning WorkOS mahsulotlaridan foydalanishi haqidagi ma'lumotlar, jumladan mahsulotdan foydalanish va ulanish yoki katalog salomatligi)
Buzilish AI agentlari moslashtirilgan hujum strategiyalarini ishlab chiqish va kirishning turli bosqichlarini avtomatlashtirish uchun ishlatilayotgan o'sib borayotgan tendensiyaning bir qismidir.
"Bu ochiq ilovalar va o'g'irlangan ma'lumotlar kabi zaifliklardan foydalanadigan hujumlarning tezligi va ko'lamini oshiradi," deb aytdi WorkOS. "Bu shubhali faoliyatni tizimlar bo'ylab bog'lay oladigan o'z vaqtida tuzatish va monitoring ehtiyojini oshiradi."
O'tgan hafta blokcheyn tahlil firmasi Chainalysis ham "hujumkor agent texnikalaridan" foydalanib o'z tizimlari va ichki vositalariga kirish huquqini qo'lga kiritgan "tashqi aktor"ni aniqlaganini ma'lum qildi. 2026-yil 2-noyabr holatiga ko'ra, kompaniya Reactor va Data Solutions mahsulotlarini proaktiv ravishda oflayn rejimga o'tkazgan.
"Biz ushbu tizimlarni g'ayrioddiy faoliyat uchun yaqindan kuzatib boramiz va sizga yangi ma'lumotlar haqida xabar beramiz, shunda siz biznesingiz va operatsiyalaringiz uchun ongli qarorlar qabul qila olasiz," deb aytdi Chainalysis.
ARTEX tomonidan nishonga olingan yana bir tashkilot — Niderlandiya Zaiflikni Oshkor Qilish Instituti (DIVD). 2026-yil 21-sentabrda sodir bo'lgan buzilish ochiq manbali Zammad chipta tizimidagi (CVE-2026-102489 va CVE-2026-102490) ikkita nol kun zaifligidan foydalanishni o'z ichiga olgan bo'lib, bu hujumchilarga imtiyozlarni oshirish, kodni masofadan ishga tushirish va ma'lumotlarni o'g'irlash imkonini bergan.
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure.
The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week.
"An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component," the company said. "We detected the intrusion, cut the access paths, and are hardening our systems."
According to the timeline of events shared by Chainstack, the attacker gained access to a development environment on October 26, 2026, and then escalated their access to break into "some parts of our production environment."
The intrusion was subsequently detected on October 31, 2026, and the attacker's access was cut off that same day, the company noted.
As part of the digital break-in, the threat actor is said to have accessed a database containing customer account information, including organization names, account holder names, the email addresses of organization’s members on Chainstack, and password hashes.
"The attacker also had access to systems holding node credentials," Chainstack said. "We have no evidence they were read, but we are treating them as exposed and ask customers to rotate them."
Besides rotating the node credentials, customers are advised to regenerate their platform API keys, update passwords -- including other services where the same password has been reused -- and remain alert to potential phishing attempts.
Although Chainstack did not disclose any specifics about the attack, it's assessed to share overlaps with a campaign undertaken by a China-linked cluster to target high-value firms using ARTEX.
WorkOS Targeted by ARTEX Too
The development comes as API platform WorkOS also disclosed a security incident that involved the same autonomous AI agent framework to conduct offensive security operations. The incident, which was discovered on October 30, 2026, was limited to its GTM systems, and did not affect production systems or customer platform data.
The accessed data includes -
- Business contact details (Names, email addresses, phone numbers, job titles, and company affiliations stored in its customer relationship management system)
- Business account and relationship information (Customer account histories and information about sales and customer-relationship information)
- Customer communications (Summaries and excerpts from sales calls, support discussions, and customer Slack conversations)
- Operational metadata (Information about customers' use of WorkOS products, including product usage and connection or directory health)
The breach is part of a growing trend in which AI agents are being employed to devise tailored attack strategies and automate different phases of the intrusion.
"This increases the speed and scale of attacks that exploit weaknesses such as exposed applications and stolen credentials," WorkOS said. "It increases the need for timely remediation and monitoring that can connect suspicious activity across systems."
Last week, blockchain analysis firm Chainalysis also revealed that it detected an "external actor using offensive agentic techniques" to obtain access to its systems and internal tools. As of November 2, 2026, the company has proactively taken its Reactor and Data Solutions products offline.
"We are closely monitoring these systems for unusual activity and will keep you apprised of new information so you can make informed decisions for your business and operations," Chainalysis said.
Another organization to be hit by ARTEX is the Dutch Institute for Vulnerability Disclosure (DIVD). The September 21, 2026, breach involved the exploitation of two zero-day flaws in the open-source Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490), enabling attackers to escalate privileges, run code remotely, and exfiltrate data.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
