Malbear: DeepSeek Agent Ran a Two-Week Telecom Intrusion

Malbear Labs has published a detailed look at what it calls Operation Snowball. A routine open-directory sweep in November 2026 turned up the full operational workspace of an autonomous AI intrusion harness in the middle of a campaign. Session transcripts, staged tools, credential caches and the agents’ own reports were all downloadable without authentication.

Everything the operator typed and everything the agents wrote back was in Chinese. The records cover more than two weeks of largely unsupervised activity against a European telecommunications provider and organisations that run systems in its data centres and cloud. Malbear is withholding the IP address of the open directory to protect the affected organisations. This account rests on Malbear’s analysis of that exposed workspace. Neither the telecom provider nor the other victims are named, and we could not independently verify the campaign.

The Harness

Malbear describes a custom agent framework built around DeepSeek Flash, at harness version 0.2.0-rc.2. The session index records a 1,000,000-token context window, which lets the primary agent keep the state of a multi-day intrusion in one context: hosts found, credentials collected, attempts made and the plan for what comes next. A primary agent delegates scoped tasks to worker agents, which report back to it as the “commander”.

Every session starts with a system prompt that replaces the model’s safety behaviour. Malbear says its core is a modified version of a publicly distributed jailbreak template known as “Little Code Sauce”, with roughly 400 lines of offensive content added. The prompt tells the model to treat a refusal as a malfunction and lists dozens of refusal phrases in English and Chinese that it must never produce.

The Operator Barely Touched It

Direction came from a standing operator prompt and a short goal for each session. The operator messages Malbear translated are brief: a target subnet, “Go on”, “Close up the latest high-risk loophole”, a list of three off-limits hosts and “Stop”. Malbear’s point is that the operator did not need to understand the technique. The agent read its own vulnerability inventory, chose the exposure and worked out the exploitation path.

Malbear is careful about one implication. This does not make the intrusion quieter. The agent scans, authenticates and moves laterally continuously and in parallel. What it defeats is any hunt aimed at the human, such as working-hours correlation or interactive-session timing.

Adapting to Defences

Malbear documents several cases of the agent working around controls without being told to:

• After Trend Micro Deep Security killed a PwnKit attempt (CVE-2021-4034), the agent used a sudo vi shell escape on the same host instead.
• When endpoint controls blocked the suo5 tunnel, a worker agent wrote a replacement Perl HTTP-to-TCP bridge in the same session.
• After OfficeScan deleted JuicyPotato on contact, the agent concluded the product was matching signatures only (behavioural monitoring disabled) and moved to script-only persistence on Windows.
• On a Liferay host with no outbound internet, the agent built a deserialization chain that needed no network callback, and Unicode-escaped webshell code to get past signature deletion.

Malbear’s own assessment is that the techniques are not the interesting part. The agent recognised a block, reasoned about why, and acted.

Entry Through Cisco BroadWorks

The primary target was a Cisco BroadWorks XSP, release 23.0.1.1075, on port 2208. Malbear reports the agent exploited CVE-2026-20320, an unauthenticated XXE flaw in the BroadWorks OCI XML parser, to read files from the server, recovering the system identity private key and several SSL credential sets. Cisco’s advisory dates from 19 August 2026 and then said Cisco was not aware of malicious use, which predates this report. CISA added the CVE to KEV on 10 November 2026. KEV shows the flaw is exploited; it does not confirm this particular campaign. Our Vuln Brief analysis of the flaw covers the fix and detection.

Scale

The figures below come from Malbear’s reading of the harness’s own records. Malbear counts hundreds of enumerated assets, over 100 tagged vulnerabilities and dozens of extracted credential sets. It reports subscriber billing and device records pulled from the provider’s internal billing platform, and millions of patient records accessed through a TrakCare Oracle instance with default database credentials. The agent also compiled a list of 13 organisations hosted on the provider’s infrastructure from public RIPE registry records.

What Defenders Should Take From It

These are our recommendations, drawn from Malbear’s account.

1. Patch BroadWorks and restrict OCI-P to known provisioning systems. If you ran an exposed, unpatched system, rotate the system identity key and SSL credentials.
2. Change default database credentials. Malbear’s account of the medical-records access rests on exactly that.
3. Do not treat signature-only antivirus as a control. Turn on behavioural monitoring.
4. Tune detection for sustained, parallel authentication and scanning rather than human working patterns.
5. Keep egress controls, but do not rely on them alone. In Malbear’s Liferay case the outbound block did not stop the agent; it forced a different exploit chain.

For related reporting, see our coverage of the SecFlow and GLUTTON operator and of autonomous lateral movement by LLM agents.

References

• Malbear Labs: Operation Snowball, Inside an Autonomous AI Intrusion Campaign
• Cisco Security Advisory cisco-sa-bworks-xxe-uwUd7CEt
• CISA Known Exploited Vulnerabilities catalog
• Vuln Brief: CVE-2026-20320 Cisco BroadWorks OCI-P XXE