{"id":"CMP-202611-xbilrl","kind":"campaign","aliases":[],"related":["CVE-2026-20320"],"title":"Operation Snowball: jailbroken DeepSeek agent harness ran a two-week intrusion on a European telecom via Cisco BroadWorks XSP XXE (CVE-2026-20320)","description":null,"summary":"Malbear Labs (2026-11-08) recovered an attacker's open directory with ~70 session transcripts of a custom autonomous agent harness (v0.2.0-rc.2) on DeepSeek Flash, jailbroken with a 78,000-character prompt built on the public 'Little Code Sauce' template. A Chinese-speaking operator gave short directives; the agent got initial access through CVE-2026-20320 (unauthenticated XXE in BroadWorks XSP OCI-P, port 2208), recovered the XSP system identity private key and SSL credentials, then moved laterally (JBoss CVE-2013-2165, Liferay CVE-2020-7961), used Sliver C2 behind Cloudflare, suo5/chisel/frp tunnels and Unicode-escaped JSP webshells, and adapted when EDR blocked tools (PwnKit blocked by Deep Security, so it used a sudo vi escape; suo5 blocked, so it wrote a Perl HTTP-to-TCP bridge). Impact figures are the researchers' reading of the agent's own reports; victims are not named or confirmed. IOCs: api.tablacysexplorer[.]com, 146.70.53[.]182, 113.23.212[.]15, 212.46.38[.]73.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-10T21:20:10+00:00","products":[],"ecosystems":[],"tags":["ai-agent","campaign","cisco-broadworks","deepseek","jailbreak","sliver","telecom"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":null,"first_seen_at":"2026-11-10T21:20:10+00:00","triaged_at":"2026-11-10T21:20:10+00:00","updated_at":"2026-11-10T21:22:03+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-10T21:22:15Z","path":"unknown","entry":"unpatched-vuln","reason":"The agent got initial access through CVE-2026-20320, an unauthenticated XXE flaw in BroadWorks XSP OCI-P that the victim ran, and the record does not say how the incident reached the victim's users, customers or dependents.","confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-08':43B '-11':42B '-2013':121B '-2020':125B '-2026':23A,94B '-202611':26A '-20320':24A,95B '-2165':122B '-7961':126B '000':68B '113.23.212':193B '146.70.53':191B '15':194B '182':192B '2026':41B '212.46.38':195B '2208':105B '70':51B '73':196B '78':67B 'access':91B 'adapt':141B 'agent':5A,30B,58B,88B,178B 'ai':29B 'ai-ag':28B 'api.tablacysexplorer':189B 'attack':46B 'autonom':57B 'behind':130B 'block':144B,147B,159B 'bridg':169B 'broadwork':19A,34B,99B 'built':71B 'c2':129B 'campaign':31B 'charact':69B 'chines':81B 'chinese-speak':80B 'cisco':18A,33B 'cisco-broadwork':32B 'cloudflar':131B 'cmp':25A 'code':76B 'com':190B 'confirm':187B 'credenti':115B 'custom':56B 'cve':22A,93B,120B,124B 'deep':149B 'deepseek':4A,35B,62B 'direct':86B 'directori':49B 'edr':143B 'escap':137B,157B 'european':15A 'figur':171B 'flash':63B 'gave':84B 'got':89B 'har':6A,59B 'http':166B 'http-to-tcp':165B 'ident':110B 'impact':170B 'initi':90B 'intrus':12A 'ioc':188B 'jailbreak':36B 'jailbroken':3A,64B 'jboss':119B 'jsp':138B 'key':112B 'lab':40B 'later':118B 'liferay':123B 'littl':75B 'malbear':39B 'move':117B 'name':185B 'oci':102B 'oci-p':101B 'open':48B 'oper':1A,83B 'p':103B 'perl':164B 'port':104B 'privat':111B 'prompt':70B 'public':74B 'pwnkit':146B 'ran':7A 'read':175B 'recov':44B,106B 'report':181B 'research':174B 'sauc':77B 'secur':150B 'session':52B 'short':85B 'sliver':37B,128B 'snowbal':2A 'speak':82B 'ssl':114B 'sudo':155B 'suo5':158B 'suo5/chisel/frp':132B 'system':109B 'tcp':168B 'telecom':16A,38B 'templat':78B 'tool':145B 'transcript':53B 'tunnel':133B 'two':10A 'two-week':9A 'unauthent':96B 'unicod':136B 'unicode-escap':135B 'use':127B,153B 'v0.2.0-rc.2':60B 'vi':156B 'via':17A 'victim':182B 'webshel':139B 'week':11A 'wrote':162B 'xbilrl':27A 'xsp':20A,100B,108B 'xxe':21A,97B","nicknames":["Operation Snowball"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["operationsnowball"],"ptokens":[],"labels":["aiagent","campaign","ciscobroadworks","deepseek","high","jailbreak","sliver","telecom","vendor"],"campaign_type":"exploitation","search_a":"'-2026':23A '-202611':26A '-20320':24A 'agent':5A 'broadwork':19A 'cisco':18A 'cmp':25A 'cve':22A 'deepseek':4A 'european':15A 'har':6A 'intrus':12A 'jailbroken':3A 'oper':1A 'ran':7A 'snowbal':2A 'telecom':16A 'two':10A 'two-week':9A 'via':17A 'week':11A 'xbilrl':27A 'xsp':20A 'xxe':21A","search_b":"'-08':43B '-11':42B '-2013':121B '-2020':125B '-2026':94B '-20320':95B '-2165':122B '-7961':126B '000':68B '113.23.212':193B '146.70.53':191B '15':194B '182':192B '2026':41B '212.46.38':195B '2208':105B '70':51B '73':196B '78':67B 'access':91B 'adapt':141B 'agent':30B,58B,88B,178B 'ai':29B 'ai-ag':28B 'api.tablacysexplorer':189B 'attack':46B 'autonom':57B 'behind':130B 'block':144B,147B,159B 'bridg':169B 'broadwork':34B,99B 'built':71B 'c2':129B 'campaign':31B 'charact':69B 'chines':81B 'chinese-speak':80B 'cisco':33B 'cisco-broadwork':32B 'cloudflar':131B 'code':76B 'com':190B 'confirm':187B 'credenti':115B 'custom':56B 'cve':93B,120B,124B 'deep':149B 'deepseek':35B,62B 'direct':86B 'directori':49B 'edr':143B 'escap':137B,157B 'figur':171B 'flash':63B 'gave':84B 'got':89B 'har':59B 'http':166B 'http-to-tcp':165B 'ident':110B 'impact':170B 'initi':90B 'ioc':188B 'jailbreak':36B 'jailbroken':64B 'jboss':119B 'jsp':138B 'key':112B 'lab':40B 'later':118B 'liferay':123B 'littl':75B 'malbear':39B 'move':117B 'name':185B 'oci':102B 'oci-p':101B 'open':48B 'oper':83B 'p':103B 'perl':164B 'port':104B 'privat':111B 'prompt':70B 'public':74B 'pwnkit':146B 'read':175B 'recov':44B,106B 'report':181B 'research':174B 'sauc':77B 'secur':150B 'session':52B 'short':85B 'sliver':37B,128B 'speak':82B 'ssl':114B 'sudo':155B 'suo5':158B 'suo5/chisel/frp':132B 'system':109B 'tcp':168B 'telecom':38B 'templat':78B 'tool':145B 'transcript':53B 'tunnel':133B 'unauthent':96B 'unicod':136B 'unicode-escap':135B 'use':127B,153B 'v0.2.0-rc.2':60B 'vi':156B 'victim':182B 'webshel':139B 'wrote':162B 'xsp':100B,108B 'xxe':97B","search_c":"","cause_entry":"unpatched-vuln","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-xbilrl","url":"https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T21:20:10+00:00","fetched_at":"2026-11-10T21:20:10+00:00","note":null,"cites":["https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign"]}],"documents":[{"id":118817,"url":"https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign","title":"Malbear Labs: Operation Snowball, autonomous AI intrusion exploiting BroadWorks XSP CVE-2026-20320","kind":"blog","source":"analyst","publisher":null,"text":"Malbear Labs, \"Operation Snowball: Inside an Autonomous AI Intrusion Campaign\", 2026-11-08. BroadWorks passages (verbatim):\n\n\"The primary target on the telecommunications provider's infrastructure was the BroadWorks XSP (eXtended Services Platform), Release 23.0.1.1075, running on port 2208.\"\n\"The agent exploited CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser. A crafted OCI request to port 2208 causes the XML parser to read arbitrary files from the server filesystem ... and no prior authentication required.\"\n\"From the XSP host, the agent recovered the system identity private key, three SSL credential sets, and three additional private keys with certificate matches confirmed. The system identity key is used by the BroadWorks platform to authenticate between its own components; possessing it allows impersonation of the XSP in inter-component communication.\"\n\"The BroadWorks Provisioning Server was separately exposed with an unauthenticated directory listing. The Provisioning Server holds subscriber configuration for every user on the platform.\"\n\nReport context: an open directory exposed ~70 session transcripts of a jailbroken DeepSeek Flash agent harness (v0.2.0-rc.2) run by a Chinese-speaking operator for 2+ weeks against a European telecom provider and 13 hosted organisations. Findings are the researchers' reading of the attacker's transcripts; victims not named, not independently confirmed.\nIOCs (from report table): api.tablacysexplorer[.]com (Sliver C2, Cloudflare-fronted); 146.70.53[.]182:2299 (SSH to Sliver server); 113.23.212[.]15:8000 (tool staging); 212.46.38[.]73:56777 (operator secondary machine). No BroadWorks-specific request IOCs published.\n","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}