Threat watch / Attack
Operation Snowball: an AI agent spends two weeks inside a European telecom provider
Malbear Labs found an exposed open directory holding the logs of an autonomous AI intrusion harness, built on DeepSeek Flash with a jailbreak system prompt, that attacked a European telecoms provider and thirteen organizations hosted on its infrastructure for more than two weeks. The researchers say it extracted dozens of credential sets and thousands of rows of subscriber billing and device records. They do not name the victims and describe the operator as Chinese-speaking.
- Sector
- Tech & SaaS
- Way in
- Software flaw
- Product or vendor
- Cisco BroadWorks, Liferay
- How it happened
- According to Malbear Labs, a custom agent framework running on DeepSeek Flash, with a primary agent delegating to worker agents and a system prompt of about 78,000 characters adapted from a public jailbreak template, scanned its targets with a portfolio of known exploits. The researchers say CVE-2013-2165 and CVE-2020-7961 (Liferay) were exploited successfully, while a PwnKit (CVE-2021-4034) attempt was blocked by Trend Micro. Access was kept through the Sliver command-and-control framework. The report says the entry point into the provider's network was CVE-2026-20320, an unauthenticated XML external entity (XXE) flaw in the OCI XML parser of the provider's Cisco BroadWorks XSP (Release 23.0.1.1075, port 2208), which let the agent read files on the server. Cisco had published a fix for this flaw on August 19, 2026.[1][3][2] Checked 11 Nov 2026
- What was stolen
- Dozens of credential sets and thousands of rows of subscriber billing and device records from the provider's billing platform, according to the researchers' reading of the agent's transcripts. Other claims in coverage have not been independently verified.[1][2] Checked 10 Nov 2026
- Who was impacted
- An unnamed European telecoms provider and thirteen organizations hosted on its data centers and cloud, which the agent itself listed as in scope. Malbear Labs withholds the directory's address to protect them. No victim has spoken publicly.[1][2] Checked 10 Nov 2026
- Threat actor
- Not attributed. Unknown. Malbear Labs says the campaign was "directed by a Chinese-speaking operator", based on the language of the instructions and Alibaba Cloud mirrors in the shell history; GBHackers notes this does not establish nationality or state sponsorship.
- CVE
- CVE-2026-20320, CVE-2013-2165, CVE-2020-7961, CVE-2021-4034
Timeline
- Malbear Labs publishes its report, "Operation Snowball": an exposed open directory held about 70 session transcripts, reconnaissance output, credential caches and database dumps from an AI intrusion harness that ran for more than two weeks. It does not publish the directory's address "to protect the affected organizations". [1][2]
- GBHackers reports on the campaign and stresses that the outcomes come from the researchers' reading of the transcripts and are not independently verified. [2]
- CISA adds the BroadWorks flaw CVE-2026-20320 to its catalog of known exploited vulnerabilities, with a patch deadline of November 24, 2026 for US federal agencies, according to The Hacker News, which links the exploitation to this campaign. Cisco's advisory, unchanged since August, still said its security team was not aware of malicious use. [4][3]