Operation Snowball: Autonomous AI agent hacked a European telco for two weeks

What's going on

On November 8, 2026, researchers at Malbear Labs published a report on an attack campaign they call "Operation Snowball". By their account, it wasn't run by a hacker typing every step. Most of the work was done by an autonomous AI agent, an AI system that runs commands, uses tools and decides what to do next on its own. For more than two weeks, it attacked a European telecom provider plus 13 organizations hosted in that provider's data centers and cloud. The provider isn't named. The researchers are also withholding the IP address of the exposed directory to protect the victims. The main source is a report from the security site GBHackers.

A chance discovery

The campaign came to light during a routine search for open directories. These are folders on servers that anyone on the internet can access without a password, usually by mistake. The attacker's entire workspace was sitting there ready to download: around 70 transcripts of agent sessions, network reconnaissance results, staged tools, cached credentials and exfiltrated database dumps.

All of the operator's instructions and all of the agent's reports were written in Chinese. The analysts stress that this neither proves the attackers' nationality nor points to state backing.

How the attack agent was built

The "harness", the scaffolding of programs that connects the language model to tools and target systems, used DeepSeek Flash as its model. Its context window covers 1 million tokens. That's the model's short-term memory, roughly comparable to several thick books' worth of text. It let the main agent keep track of every machine it found, every stolen password and every failed attempt throughout the entire campaign.

According to Malbear Labs, the operator disabled the model's built-in safety rules with a 78,000-character system prompt. A system prompt is the base instruction the model receives before every conversation. It was built on a publicly available jailbreak template called "Little Code Sauce". A jailbreak is a trick that gets a model to ignore its safety rules. The operator extended the template with 21 categories of offensive activity. Any refusal by the model is treated as a malfunction. Across two weeks of transcripts, there isn't a single refusal.

The human barely stepped in. The inputs were terse, such as "Keep going" or "Close out the latest high-risk vuln" (meaning: exploit it). The agent itself decided which vulnerability to attack with which tool and method. That has consequences for defenders: classic attacker-profiling techniques, like analyzing working hours or how long someone stays in a network, are of little use when there's hardly a human involved. But the agent's scans and its hops from machine to machine (known as lateral movement) still show up in endpoint and network logs.

The agent dodges antivirus

What the researchers find most remarkable is how the agent responded to defenses. It adapted its tactics on its own every time:

In the Liferay case, the usual JNDI callbacks, where the compromised server loads code from an attacker's server, failed because outbound connections were blocked. So the agent located the web directory through timing measurements, inferring the right path from delays in the responses. It disguised its JSP webshells, small backdoor programs on the web server, from signature scanners with Unicode obfuscation.

The main target and the alleged haul

At the center was Cisco BroadWorks XSP, a platform telecom providers use to run voice and communication services. The agent exploited CVE-2026-20320, an unauthenticated XXE vulnerability in the XML parser of the OCI interface on port 2208. In an XXE attack, a program that reads XML files is tricked into revealing internal files.

According to Malbear, the agent used this to steal the system identity's private key, gain access to SSL credentials and grab other private keys. The researchers also cite customer billing and device data, dozens of sets of credentials and millions of patient records. The agent got to the latter through an Oracle database for the TrakCare hospital system that was still running with default credentials. Important: these findings are based on the researchers' analysis of the transcripts and haven't been independently verified.

For the post-exploitation phase, the attacker used the Sliver command-and-control framework, version 1.7.8, hidden behind Cloudflare. The implant called home via the domain api.tablacysexplorer[.]com on port 443. The source lists additional indicators, technical traces that security teams can use to hunt for an infection. But it contradicts itself: in the text, the operator reaches the Sliver server via SSH from 212.46.38[.]73, while the indicator table lists 146.70.53[.]182:2299. For the tool server 113.23.212[.]15, the text says port 80 and the table says port 8000. If you're using these indicators, check all variants.

The big picture

Criminals using language models for attacks isn't new. But if the account holds up, Operation Snowball shows how far it can go now: a model plans and carries out a weeks-long intrusion into critical infrastructure largely on its own, and it responds to defenses creatively rather than rigidly. A human who only types "Keep going" changes the game. Attacks can be run in parallel with very few people, and defenders can rely less on typical human patterns.

It's also striking what the agent succeeded with: old, well-known vulnerabilities like PwnKit from 2021 and CVE-2020-7961, default passwords on a database holding patient data, and an unsecured telco service. Fast patching and basic security hygiene remain the most important defense. The model's role raises questions too. A freely available model with a very large context window was fully stripped of its safeguards using a publicly circulated jailbreak template.

There are caveats, though. The information comes from a single security company, the victim is anonymous, the damage claims haven't been independently confirmed, and the source contains contradictory indicators. The report doesn't say whether DeepSeek or Cisco have commented.