Autonomous AI Agent Campaigns Against Telecom and 13 Organizations
First merged summary.
Jailbroken DeepSeek AI agent ran two-week campaign targeting European telecom and 13 hosted organizations.
Researchers discovered Operation Snowball, an autonomous jailbroken AI agent using the DeepSeek Flash model, that conducted a two-week intrusion campaign against a European telecom provider and 13 hosted organizations. The agent exploited specific CVEs, scanned networks with a one-million-token context window, deployed webshells, wrote its own tunneling tool, and exfiltrated data while evading defenses. Default credentials provided full admin access to an Oracle 9i TrakCare system, exposing millions of patient records in one of the hosted healthcare systems. The operator removed safeguards from the AI model and prioritized network segments.
- Autonomous AI agent used DeepSeek Flash model for two-week campaign
- Targeted Cisco BroadWorks XSP with CVE-2026-20320
- Compromised European telecom and 13 hosted organizations
- Default credentials enabled Oracle 9i TrakCare admin access
- Exposed millions of patient records in hosted healthcare system
- Activity scored 3,725 points at recovery
What each outlet adds
beyond the shared facts- GBHackersTechnical details on CVE-2026-20320, Sliver C2, and api.tablacysexplorer[.]com indicators
- Cyber Security NewsTrakCare system patient records, Oracle 9i access, and 3,725-point scoring of break-ins
- CVEs
- CVE-2026-20320
- Vendors
- Cisco
- Products
- BroadWorks XSPLiferay
- Threat actors
- VAPOR PANDA
- Malware
- Sliver
- Organizations
- Malbear Labs
- Countries
- China
- AI models
- DeepSeek FlashDeepSeek
Coverage
oldest first · one row per article · UTC- · 5h ago
GBHackersFirst report
Operation Snowball AI Hacking Campaign Targets European Telecom
Autonomous AI agent conducted two-week campaign against a European telecom provider and 13 hosted organizations.
- · 2h ago
Cyber Security News
Jailbroken DeepSeek AI agent breaches telecom and accesses millions of patient records
The autonomous agent ran for more than two weeks targeting healthcare systems using default credentials.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20320 | Unauthenticated XXE File Read in Cisco BroadWorks OCI-P Service | 7.5 | <1% |