Operation Snowball AI Hacking Campaign Targets European Telecom
Original title: Operation Snowball Exposes AI Hacking Campaign Targeting European Telecom and 13 Hosted Organizations
Autonomous AI agent conducted two-week campaign against a European telecom provider and 13 hosted organizations.
Researchers uncovered Operation Snowball, an autonomous AI intrusion harness using DeepSeek Flash model that attacked a European telecom and 13 data center organizations. The campaign involved exploiting specific CVEs and evading defenses. The operator's instructions were in Chinese.
Unconfirmed: Nationality of the operator not confirmed.
- Targeted Cisco BroadWorks XSP using CVE-2026-20320
- Used Sliver for post-exploitation C2
- Operator removed safeguards from AI model
- Indicators include api.tablacysexplorer[.]com
Impact: unauthorized access to telecom and hosted systems
- CVEs
- CVE-2026-20320
- Vendors
- Cisco
- Products
- BroadWorks XSPLiferay
- Malware
- Sliver
- Organizations
- Malbear Labs
- Countries
- China
- AI models
- DeepSeek Flash
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20320 | Unauthenticated XXE File Read in Cisco BroadWorks OCI-P Service | 7.5 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | tablacysexplorer.com | v1.7.8 with Cloudflare fronting. The beacon domain was api.tablacysexplorer[.]com on port 443. The operator reached the team server over SS |
| ipv4 | 113.23.212.15 | rver over SSH from 212.46.38[.]73, and a tool server ran at 113.23.212[.]15:80 Indicators of Compromise Indicator Type Description ap |
| ipv4 | 146.70.53.182 | er[.]com Domain Sliver C2 beacon domain, Cloudflare-fronted 146.70.53[.]182:2299 IP:port SSH access to Sliver server 113.23.212[.]15: |
| ipv4 | 212.46.38.73 | ort 443. The operator reached the team server over SSH from 212.46.38[.]73, and a tool server ran at 113.23.212[.]15:80 Indicators o |
From the original article
3 min read at gbhackers.com
An exposed open directory revealed an autonomous AI intrusion harness that spent more than two weeks attacking a European telecom provider and 13 organizations hosted in its data centers and cloud. The report, published on November 8, 2026, calls the campaign Operation Snowball. The researchers withheld the directory’s IP address to protect the victims.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.