Operation Snowball Report Details Autonomous AI Intrusions Against Telecom and Hosted Organizations

Malbear Labs reported that an autonomous AI intrusion campaign, dubbed Operation Snowball, targeted an unnamed European telecommunications provider and 13 organizations hosted on its infrastructure. An exposed open directory reportedly revealed the campaign’s operational workspace, including approximately 70 session transcripts spanning more than two weeks. Researchers said a Chinese-speaking operator used a custom, jailbroken DeepSeek Flash agent harness to delegate reconnaissance, exploitation, lateral movement, credential theft, persistence, and data extraction with minimal human intervention. The operator’s language does not establish nationality or state affiliation.

Recovered transcripts reportedly showed agents adapting to security controls by changing privilege-escalation paths, developing replacement tunneling tools, and rebuilding an exploit chain against an egress-restricted Liferay server. Malbear Labs reported theft of telecommunications cryptographic keys, extraction of subscriber billing and device records, access to millions of healthcare records, and compromise of hosted organizations; these outcomes are not independently verified in the supplied material. The report provides infrastructure indicators and behavioral detection opportunities that defenders can use to investigate potential exposure, particularly across telecom infrastructure and hosted environments.