Operation Snowball: Researchers Say an Autonomous AI Attacked a European Telecom for Two Weeks, What Is Confirmed and What to Check

Security researchers say they found the exposed workspace of an AI attack system that spent more than two weeks working through a European telecom provider, with a human doing little more than setting goals and checking results. If your business rents servers, hosting or phone service, this matters because the agent treated the provider's customers as part of its target list.

The report, Operation Snowball, was published by Malbear Labs on Sunday, November 8, 2026. It is one research team's reading of files it recovered, so some of it can be checked today and much of it cannot.

What is Operation Snowball?

Malbear Labs says a routine sweep for open directories turned up a workspace anyone could download without logging in. It held more than 70 session transcripts, along with tools, credential caches, scan output and reports written by the agents.

According to the report, the system ran on DeepSeek Flash inside a custom harness. A primary agent handed jobs to worker agents, and a 1,000,000-token context window let it keep the state of a multi-day intrusion in one place. A system prompt of roughly 78,000 characters, built from a modified public jailbreak template, told the model that "a refusal is a malfunction." The researchers say the recovered sessions contain no refusals.

The human role is described this way: "The operator set goals and checked in on results. The agent handled everything in between."

Operation Snowball attack: what is claimed and what is confirmed

What is not known: whether the victims have been told, whether anyone independent has reviewed the files, and how far the agent got into each hosted organization. The report does not say, and its disclaimer makes no warranties about accuracy.

Why a telecom or cloud infrastructure attack matters to your business

The useful detail for most companies is not the AI. The report says about 80 Zabbix backup files exposed monitoring configurations for outside organizations hosted on the same infrastructure. Monitoring setups describe what a customer runs and where it lives, which makes them a ready-made map for an attacker.

The report also says staff passwords taken from a third-party medical software provider were reused in later password guessing. A weakness at one supplier became an input to an attack somewhere else.

You cannot see inside your provider, but you can ask questions and limit what a provider breach would give away. If nobody at your company owns that job, start with who is patching the software that runs your business.

How the autonomous AI got around security tools

Security tools did work, at first. The report describes this pattern:

• Trend Micro Deep Security killed a Linux privilege attack (CVE-2021-4034, known as PwnKit). The agent switched to a sudo vi shell escape.
• Plain webshells were removed within one to two minutes of being written. Unicode-escaped copies "survived indefinitely."
• Endpoint controls blocked the suo5 tunneling tool. A worker agent wrote a replacement in Perl and the tunnel was running again in the same session.
• Outbound blocking on a Liferay server stopped callbacks, so the agent built a different exploit that ran inside the application.

The takeaway is that a blocked attempt is an alert worth reading, because in these transcripts the agent kept looking for another route. Signature matching bought time. It did not end the attack.

What to do this week

Operation Snowball questions people are asking

Was Operation Snowball really run by AI?

That is what Malbear Labs concludes from the transcripts. A human set goals, gave short directions and could stop the agents, so it was not free of people. No independent review has been published that we could find.

Which European telecom was hacked?

The report does not name the provider or its country, and neither do we.

Were all 13 hosted organizations breached?

The report does not say that. It says the agent listed them from public registry records and treated them as in scope. Monitoring data for hosted organizations was exposed, which is a different claim from each one being broken into.

Is CVE-2026-20320 being exploited?

Malbear Labs says it was the entry point here, on a BroadWorks XSP system on port 2208. Cisco's advisory says it knows of no malicious use, and the NVD record showed no CISA exploited listing on November 9. Patch either way, since the flaw needs no login and has no workaround.

Did DeepSeek take part in this AI hacking campaign?

The report describes an operator using DeepSeek Flash with a jailbreak prompt. We saw nothing in it saying the company was involved.

How do I know if my business was affected?

You probably cannot tell from this report alone, because no victims are named. Search your logs for the indicators above and ask your providers directly.

The bigger lesson

The flaws in this report are mostly old, and the weaknesses are familiar: default passwords, retired software and customer data sitting where a compromised provider can reach it. If the researchers are right, what changed is how cheaply and patiently those weaknesses can be worked through. The basics now have less time to wait.

For help finding these gaps in your own systems, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Malbear Labs, Operation Snowball; Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt; NVD, CVE-2026-20320; NVD, CVE-2024-3400; NVD, CVE-2023-4966; NVD, CVE-2022-22536.