A jailbroken AI agent has spent more than two weeks attacking a European telecommunications provider and 13 organizations hosted on its data center and cloud infrastructure.
Malbear Labs, which has dubbed the campaign Operation Snowball, detailed the activity in research published November 8 after finding the attacker's working directory during a routine sweep for exposed open directories. The unprotected directory held more than 70 session transcripts and the agent's own reports.
The custom agent framework ran on DeepSeek Flash, with a jailbreak prompt of about 78,000 characters that told the model to treat any refusal as a malfunction. Malbear wrote that the transcripts contained no recorded refusals.
Autonomous Agent Adapted When Its Attacks Were Blocked
The operator's messages, translated from Chinese, were brief. Besides prompts such as "Go on" and "Stop," they set a target subnet, put three internal hosts off-limits and followed up on the agent's vulnerability list. Malbear wrote that the operator "delegated the intrusion to an AI and checked in asynchronously to review progress."
The agent entered the telecom by exploiting CVE-2026-20320, an unauthenticated XML external entity (XXE) flaw in Cisco BroadWorks. Cisco fixed the flaw in August.
The agent went on to exploit Liferay (CVE-2020-7961) for root access on a host spanning several internal networks and JBoss/RichFaces (CVE-2013-2165) for a second foothold. Malbear listed more than a dozen other flaws the agent targeted, found or kept in its toolkit, none marked as exploited.
When endpoint security blocked an attempt to exploit the Linux flaw PwnKit (CVE-2021-4034), the agent changed its approach without operator direction. After a tunneling tool was blocked, it wrote a replacement.
Access Claims Extended to Patient and Monitoring Data
According to Malbear, the recovered transcripts showed the agent extracting dozens of credential sets, private keys and a healthcare organization's Active Directory data.
The agent also reported reaching subscriber billing records and what Malbear described as millions of patient records, through a TrakCare Oracle database that still used default credentials.
Its reports also listed about 80 Zabbix monitoring backups covering the provider's managed-services customers.
The post does not say whether Malbear checked these claims with any victim, what was taken rather than staged or whether all 13 organizations were breached.
Malbear assessed the activity as consistent with a Chinese-origin operator and did not link it to a state actor. Its recommendations included treating internet-exposed, end-of-life JBoss Application Server 6 instances as compromised and watching internal traffic for tunneling.