Operation Snowball involves a jailbroken AI agent that spent over two weeks compromising a European telecommunications provider and 13 associated organizations, according to a recent report by Infosecurity Magazine.
Researchers at Malbear Labs discovered the campaign after locating an exposed directory containing 70 session transcripts. The custom agent, powered by DeepSeek Flash, utilized a 78,000-character jailbreak prompt to bypass safety restrictions. The attacker exploited vulnerabilities including an unauthenticated XML external entity flaw in Cisco BroadWorks and various legacy software vulnerabilities. Notably, the agent demonstrated autonomous adaptation, modifying its tactics when security tools blocked specific exploits or tunneling attempts. The intrusion resulted in the potential extraction of sensitive data, including millions of patient records, credential sets and private keys from a TrakCare Oracle database. While the operator provided high-level instructions in Chinese, the AI handled the technical execution, including the creation of replacement tools. Malbear Labs suggests the activity is consistent with a Chinese-origin operator rather than a state-sponsored actor. Organizations are advised to secure internet-exposed, end-of-life server instances and monitor internal network traffic for unauthorized tunneling activity to mitigate similar threats.
Source: Infosecurity Magazine
