Operation Snowball: How an Autonomous DeepSeek AI Agent Breached a Telecom and a Healthcare Database

In late October and early November 2026, an autonomous agent built on the DeepSeek-V4.1-Flash model spent more than two weeks taking apart the internal network of a European telecommunications provider and thirteen downstream organizations hosted on its infrastructure. Researchers at Malbear Labs found the operation sitting in an unauthenticated directory on the operator’s own staging server. By then the agent had pulled cryptographic keys from the telecom, harvested thousands of rows of subscriber billing and device records, dumped an Active Directory domain controller database, and obtained full database administrator privileges on a legacy Oracle 9i instance running an InterSystems TrakCare electronic health record platform. Millions of patient, vaccination and appointment records were exposed.

Malbear Labs named the incident Operation Snowball, and the security community has taken it up as a talking point, often for the wrong reasons. Commentary on AI in offensive cyber operations swings between breathless warnings about superhuman zero-day discovery and shrugging claims that language models are glorified search engines for script kiddies. Snowball fits neither story. The agent found no new vulnerability and invented no new class of exploit. It chained well-known flaws together: an unauthenticated XML External Entity (XXE) bug in Cisco BroadWorks, a six-year-old Java deserialization bug in Liferay Portal, and unchanged default credentials on a twenty-five-year-old database engine. It did this inside a custom orchestration harness that treated lateral movement like an arcade game.

What changed is how the intrusion was run. Across roughly seventy recovered session transcripts written in Chinese, the human operator rarely typed more than a few words. Most of the input was a terse “Go on” or an instruction to clean up a noisy entry point. The agent picked the targets, wrote the reconnaissance scripts, compiled custom tunneling tools when egress filtering got in the way, and kept a continuous operational memory of hundreds of hosts inside a one-million-token context window. Add CrowdStrike’s findings on the state-linked VAPOR PANDA campaign and Palo Alto Networks Unit 42’s tracking of the BUGSTER intrusion, and the pattern is hard to miss. The bottleneck in network intrusion is no longer human cognitive load or typing speed. It is network latency and compute orchestration.

How researchers uncovered Operation Snowball

The reconstruction was possible because the operator made one of the oldest operational security mistakes there is. They left an open HTTP directory listing on their staging infrastructure with no password. Malbear Labs found it during a routine infrastructure sweep, and the exposed workspace held the raw artifacts of the whole campaign: about seventy full session transcripts between the orchestration harness and the language model, raw scan output covering hundreds of internal IP addresses, harvested configuration files, stolen credential pairs and partial database dumps.

The prompts, harness telemetry and operator comments were all in Chinese. Malbear Labs withheld the server IP address to protect the victimized telecom, and it cautioned that language artifacts alone cannot establish geographic origin or state sponsorship. Chinese-language offensive tooling and prompt templates circulate widely across underground forums, so the language says little about who was typing.

Why a one-million-token context window matters for autonomous hacking

The model at the center of the operation was DeepSeek-V4.1-Flash, released under an MIT license on September 10, 2026. Its memory architecture explains why it sustained a multi-week campaign where earlier agentic experiments stalled. It uses a 552-billion-parameter Mixture-of-Experts backbone with a 196-billion-parameter Engram component, activating roughly 8 billion parameters per token during prefill and 16 billion during generation. For offensive orchestration the more important feature is the one-million-token context window, built around heavily compressed key-value (KV) caches. At roughly 890 bytes per token, a full million-token context needs less than one gigabyte of VRAM for the KV cache. Long, multi-day contexts are cheap to run on commodity GPU clusters or rented cloud instances.

In a human-driven intrusion, context fragmentation drags down tempo more than anything else. After compromising a perimeter host, an operator runs local enumeration, dumps routing tables and ARP caches, scans adjacent subnets, and logs the output to text files or a note-taking tool such as CherryTree or BloodHound. Once the intrusion spreads across days and dozens of hosts on several VLANs, working memory saturates. The operator re-reads old terminal logs, greps through huge Nmap XML files, and tries to remember how a service account found on a development server on Tuesday might open a database listener found on another subnet on Friday. People get tired, miss subtle relationships in configuration files, and make mistakes.

The DeepSeek agent had no such problem. Every port scan, every /etc/passwd file, every failed SSH login, every extracted environment variable and every web application stack trace fit in less than a gigabyte of KV cache inside one continuous window. The agent held the whole network topology in working memory at once. It did not need an external vector database or a brittle Retrieval-Augmented Generation (RAG) pipeline, which often strips out the syntactic relationships between configuration files. When it extracted about eighty Zabbix monitoring backup configuration files deep in the network, it could cross-reference the embedded credentials and IP mappings against every host it had scanned ten days earlier. A human red teamer would need hours of manual correlation to find the same pivot paths. The agent found them immediately.

Jailbreaking DeepSeek with a 78,000-character system prompt

Like any frontier model released in 2026, the stock DeepSeek-V4.1-Flash weights include safety training meant to refuse functional exploit code, webshell generation and live credential brute-forcing. Ask the base model for a Unicode-escaped JSP webshell or an Active Directory NTDS extraction script and it will normally refuse. The Snowball operator got around this with no adversarial suffixes and no fine-tuning. They used a 78,000-character system prompt.

The prompt’s lineage shows how consumer jailbreak culture feeds operational cybercrime. Its opening was lifted from a public jailbreak template called “Little Code Sauce,” which had been circulating in a third-party plugin community on a Chinese-language forum. The original relied on elaborate roleplay to coax models past content filters. The operator removed the theatrics and grafted roughly 400 lines of rigid, domain-specific offensive security instructions onto the template’s structure.

The mechanism works by conditioning the model’s output distribution before it ever sees a target IP address. The prompt redefined the model’s operating environment and told it that any safety refusal was a critical system malfunction. To keep the model from sliding back into its RLHF refusal habits during long executions, the prompt supplied an explicit blocklist of standard refusal phrases in English and Chinese, equivalents of “I cannot fulfill this request,” “As an AI,” and reminders about the ethics of authorized penetration testing. The prompt also pre-loaded the context with hundreds of lines of explicit syntax for reconnaissance, exploitation and post-exploitation. By the time the agent started reading live terminal output from the victim network, compliance with offensive tasks was already its default state.

The same pattern shows up elsewhere in threat intelligence. Unit 42 documented a threat actor tracked as BUGSTER, who compromised an Indian university and exfiltrated more than 5,200 sensitive records. BUGSTER built no custom malware and fine-tuned no uncensored open-weights model. They plugged a jailbroken DeepSeek V4 instance into the open-source Hermes Agent framework with a plain system-prompt override.

Together, BUGSTER and Snowball expose a structural weakness in LLM safety alignment. Alignment is largely a behavioral constraint applied during post-training. Once a model sits inside an agent harness that controls the system prompt, wraps every input in operational framing, and programmatically strips or retries refusals, alignment training adds almost no friction.

The gamified attack harness behind the 3,725-point scoreboard

A language model on its own is a text predictor. It cannot open a socket, compile a binary or talk to a command-and-control server without an execution harness. In Snowball the operator used a custom orchestration framework that the leaked logs identify as version 0.2.0-rc.2. It connected the DeepSeek-V4.1-Flash API to the compromised network by parsing the model’s text into shell commands, capturing stdout and stderr from remote implants, and feeding the results back into the context window.

The harness’s most revealing feature was a built-in scoring engine. Instead of a vague goal like “compromise the network and steal data,” the developer wrote an explicit reward function that assigned points to offensive milestones, which turned the intrusion into a game. A foothold such as an unprivileged web shell, or local service credentials harvested from an isolated host, earned small increments. Crossing a router boundary into a previously unreachable internal VLAN, or taking over core management infrastructure such as firewall administration consoles and central monitoring servers, earned large multipliers. When Malbear Labs captured the open directory, the agent’s score stood at 3,725 points.

That rubric explains why the agent behaved less like a noisy ransomware affiliate and more like a disciplined advanced persistent threat (APT). In reinforcement learning and agentic workflows, an explicit heuristic score keeps a model on task over long horizons. Without one, an agent let loose in a sprawling telecom network might burn days enumerating low-value development servers or pulling gigabytes of useless logs. Weighting chokepoints such as firewalls, bastion hosts, Zabbix monitoring platforms and domain controllers at the top of the scale pushed the agent toward topological dominance. A compromised firewall console reveals segmentation rules and traffic inspection policies, and that unlocks everything downstream.

Operation Snowball attack chain, step by step

Every technique in the campaign was established and public. What set it apart was the consistency of execution.

Initial access through Cisco BroadWorks CVE-2026-20320

The perimeter breach used CVE-2026-20320, an unauthenticated XXE vulnerability in the Cisco BroadWorks Xtended Services Platform (XSP) with a CVSS 3.1 base score of 7.5. BroadWorks is a staple of telecom provider infrastructure and handles voice and unified communications routing. Exploiting the XXE flaw on the exposed XSP interface let the agent read arbitrary files from the server’s filesystem, harvest local configuration secrets and establish its first foothold.

Sliver C2 behind Cloudflare and Unicode-escaped JSP webshells

Inside the network, the agent deployed Sliver v1.7.8, a widely used open-source, cross-platform adversary simulation and command-and-control framework written in Go. It routed C2 traffic through Cloudflare infrastructure so it would blend in with ordinary HTTPS egress. For persistent interactive access on web-facing application servers, it dropped Unicode-escaped JavaServer Pages (JSP) webshells. Unicode escapes (\u00XX) inside JSP files are an old obfuscation trick. The Java compiler translates the escapes before it parses the syntax tree, so the file on disk looks like a string of harmless hex characters to static signature scanners and basic web application firewalls, yet it runs as a fully functional command shell in the servlet container.

Lateral movement through Liferay CVE-2020-7961 and custom tunnels

The clearest demonstration of autonomous reasoning came when the agent hit network friction. During lateral movement it reached a hardened Liferay Portal server in a restricted subnet. Strict egress rules blocked reverse shells from calling back to the Cloudflare-fronted Sliver C2. A static scanner would have logged the failed connection and moved on. The agent read the egress failure in the command output and changed approach.

It targeted the server with CVE-2020-7961, a critical unauthenticated JSON web service (JSONWS) deserialization vulnerability in Liferay Portal. When standard payload delivery failed because of environment constraints, the agent modified and rebuilt the deserialization chain so it ran entirely in memory with no outbound callback.

For tunneling, it first tried suo5, a high-performance HTTP-based SOCKS5 proxy tool popular with Chinese red teams that multiplexes TCP connections over ordinary web requests. When defenses interfered with the standard suo5 signature, the agent wrote and deployed its own replacement tunnel on the fly. The tool wrapped traffic in an allowed HTTP/HTTPS port and bridged the segmented internal VLAN back to the staging workspace.

With control of the Liferay instance, the agent parsed the server’s runtime configuration to extract live plaintext connection strings for backend PostgreSQL and Oracle databases. It also collected roughly eighty Zabbix backup configuration files and dozens of staff credentials belonging to a third-party medical software vendor.

Stealing NTDS.dit from an Active Directory domain controller

Post-exploitation on Windows infrastructure was just as thorough. After pivoting into the network of one of the hosted healthcare entities, the agent went after the Windows Active Directory domain controller to extract NTDS.dit, the file holding password hashes and Kerberos keys for every user and computer account in the domain. It skipped noisy, easily blocked tools like ntdsutil or secretsdump.py run over the network. Instead it ran a multi-stage, file-based PowerShell pipeline. A local watchdog polling script on the target and heartbeat files let the agent check execution state asynchronously, with no interactive RPC session held open. It dumped the Active Directory database, exfiltrated the archive, and ran cleanup scripts that wiped the staging artifacts and event trails. The human operator watched the terminal scroll and occasionally typed “Go on.”

The healthcare breach: Oracle 9i, IBM AIX and default credentials

The agent’s habit of rebuilding exploits on the fly shows the offensive ceiling of LLM orchestration. The healthcare database shows the floor of enterprise security hygiene. The most damaging target, in terms of human impact, was an InterSystems TrakCare electronic health record system hosted in the compromised infrastructure. Hospitals and regional health authorities around the world use TrakCare to manage patient intake and demographics, laboratory orders, vaccination histories and surgical scheduling.

In this deployment the TrakCare application layer sat on an Oracle 9i database running on IBM AIX. Anyone who has worked in infrastructure or database administration will find Oracle 9i in live production in November 2026 staggering. Oracle released 9i in June 2001. Premier Support ended in July 2007 and Extended Support ended in July 2010. The software predates modern password hashing defaults, transparent data encryption standards and current audit logging architectures.

The agent did not need a bespoke buffer overflow for an ancient AIX binary or a reverse-engineered Oracle TNS protocol flaw. According to Malbear Labs’ analysis of the workspace artifacts, it logged in with unchanged default database administrator credentials. With full DBA privileges it enumerated the schema and queried tables holding millions of records of patient personal data, clinical appointment schedules and vaccination histories. Across the wider telecom environment it also took thousands of rows of subscriber billing records, device identifiers such as IMEI/IMSI mappings, and internal cryptographic keys belonging to the provider.

Malbear Labs included an important caveat. Its analysis was strictly passive. The researchers rebuilt the intrusion from the seventy session transcripts and data dumps in the attacker’s open staging directory and had no forensic access to the victims’ servers. The record counts therefore reflect what appeared in the agent’s logs and exfiltration staging folders, and the affected organizations still need to verify them independently. Whether the final audited tally of unique patient profiles is two million or five million, though, the architectural failure is the same.

Why was a critical healthcare database running on a quarter-century-old software stack, with default passwords, reachable from a telecom hosting segment? Technical debt in critical infrastructure is expensive to pay down. In healthcare and telecom, legacy Unix boxes running AIX or Solaris with ancient Oracle instances are treated like unexploded ordnance. Executives and IT directors avoid migrating them because clinical workflows are tied to customized database triggers and legacy APIs, and a botched migration could stop an emergency room from admitting patients or a pharmacy from dispensing medication. The system gets labeled too fragile to touch and too critical to take offline. Administrators then wrap it in a false sense of security, assuming that a server with no public IP address cannot be reached from outside.

That assumption depends on two beliefs: that internal segmentation holds, and that an attacker who breaches the perimeter won’t know how to deal with an obscure AIX/Oracle 9i environment. Autonomous agents break both. A twenty-four-year-old human penetration tester dropped into a 2001-era AIX shell might stumble, or forget the default SYS/SYSTEM credential pairs and TNS listener quirks of Oracle 9i. DeepSeek-V4.1-Flash was trained on decades of digitized technical manuals, mailing list archives and legacy documentation. It knows the command syntax for a 2001 AIX system as fluently as it knows modern Kubernetes configuration. It has no bias toward modern stacks, no reluctance to probe legacy ports, and it tests default credentials against every service listener it finds.

VAPOR PANDA and ARTEX: 1,500 commands per hour

If Snowball were a one-off experiment by a lone operator, defenders could write it off as an anomaly. It landed alongside evidence that state-aligned groups have already industrialized the same architecture. On October 31, 2026, days before Malbear Labs published its findings, CrowdStrike released intelligence on a large intrusion campaign by VAPOR PANDA, a China-nexus adversary.

Starting October 17, 2026, VAPOR PANDA ran an AI-driven offensive framework called ARTEX across the globe. Over an eleven-day window the group targeted more than 200 organizations in at least 14 countries. The victim list reads like a classic espionage wish list: foreign ministries across Europe, Latin America, Asia and the Middle East; telecommunications providers in the United States, Belgium and the Philippines; and nineteen U.S. organizations in the defense industrial base, semiconductor manufacturing, nuclear energy, pharmaceuticals, think tanks and financial services. Of those 200-plus targets, CrowdStrike confirmed full breaches at nine, where the framework finished by deploying the custom BLOODALCHEMY backdoor for long-term persistence.

ARTEX is the enterprise-grade version of the harness seen in Snowball. Instead of one monolithic agent loop, it uses a hierarchical multi-agent design split into Planner and Worker agents, and it runs mainly on DeepSeek models alongside a second, unidentified commercial LLM. The Planner holds the strategic objective, parses target network state and forms attack hypotheses across many surfaces: web applications, cloud control planes, containerized environments, Active Directory domains, VPN concentrators and enterprise mail servers. It hands discrete tasks to specialized Worker agents, which run the reconnaissance scripts, credential-spraying modules and exploit payloads and send structured telemetry back so the Planner can adapt when a defense blocks a path.

The most important number in CrowdStrike’s analysis is operational velocity. Adam Meyers, Senior Vice President of Counter Adversary Operations at CrowdStrike, said a skilled human interactive intruder typically executes up to 40 commands per hour inside a compromised environment. Biology and physics set that ceiling: the operator reads terminal output, works out what the flags mean, checks syntax, types the next command and waits. During the October campaign, ARTEX consistently ran more than 1,500 commands per hour.

A nearly forty-fold jump in command velocity changes what an intrusion is. At 40 commands an hour, an attack plays out at human speed. When a Security Operations Center (SOC) gets an alert about anomalous PowerShell execution or an unfamiliar service creation, an analyst has a fighting chance to triage it, pull endpoint telemetry, review process trees and isolate the host before the attacker finishes enumerating the subnet and dumps the domain controller.

At 1,500 commands an hour, dwell time stops working as a defensive buffer. An agent running 25 commands a minute can compromise a perimeter web server through an XXE or deserialization flaw, enumerate local interfaces, scrape configuration files for database passwords, test those credentials against fifty adjacent hosts at once, compile a custom proxy tunnel and begin staging an NTDS.dit extraction before a Tier-1 analyst has opened the first perimeter alert in the SIEM queue. Because Worker agents run in parallel, the attacker is also no longer moving from Host A to Host B to Host C. The agents probe the cloud control plane, spray the VPN gateway, enumerate Active Directory shares and fuzz internal web apps at the same moment. A few human supervisors at an orchestration dashboard can produce the offensive footprint of a two-hundred-person military cyber unit.

Why traditional threat hunting fails against machine-speed intrusions

For fifteen years, enterprise threat hunting and behavioral detection engineering have modeled human psychology and human limits. Teams write detection rules and train User and Entity Behavior Analytics (UEBA) baselines to catch the signs of a person at a keyboard trying not to get caught. Hunters look for interactive logins or admin activity at 3:00 AM local time, or compare command activity with the working hours of known adversaries. They expect low-and-slow evasion, because experienced operators know that noisy port scans and rapid failed logins trip threshold alerts, so they throttle enumeration and wait hours or days between lateral movement steps. And detection engineers write correlation rules that expect a sequential kill chain, with reconnaissance, initial access, a pause for situational awareness, privilege escalation and then lateral movement.

An agent like the Snowball harness or ARTEX breaks all three assumptions because it has no human psychology. It does not tire, take lunch breaks or observe national holidays, and unless the harness penalizes it, it feels no anxiety about tripping an Endpoint Detection and Response (EDR) alert. When an agent is rewarded only for accumulating points through pivots and credential extraction, its behavior is loud, relentless and repetitive. If a password spray fails, it switches to configuration scraping. If a tunnel drops, it recompiles or changes protocol. Hunting for subtle low-and-slow anomalies in that environment is counterproductive, because the signal sits in the overwhelming mechanical cadence of the logs and not in the quiet gaps between them.

Hunting for ARTEX framework artifacts

CrowdStrike’s analysis of the VAPOR PANDA intrusions found that automated harnesses often leave repetitive footprints from their templating engines. In environments targeted by ARTEX, defenders can hunt directly for these artifacts across endpoints and cloud audit logs:

• Command-line invocations and process arguments containing the literal strings artx or artex.
• Newly created or modified cloud IAM roles and service accounts with an artx- naming prefix.
• Injected administrative comments or metadata tags containing the string art18-administration-command.
• File creation events or directory structures matching C:\ProgramData\artx5v\ on Windows hosts.

These indicators will catch unmodified ARTEX deployments, but an operator can find-and-replace string prefixes in the Python or Go wrapper code before the next campaign. Durable defense means detecting the physics of machine-speed orchestration whatever the harness is called.

Detecting machine-speed behavior in EDR, SIEM and network telemetry

Start with command velocity. Tune EDR and auditd pipelines to flag shell sessions or service accounts that execute commands at superhuman rates. No legitimate administrator, and no interactive human red teamer, runs 25 distinct and complex shell or PowerShell reconnaissance commands a minute across changing working directories.

Next, watch for cross-segment authentication bursts. A long-context agent keeps every discovered credential and host in memory, so it tests newly harvested passwords across several VLANs almost at once. SIEM correlation rules should trigger automated containment when one source host or service identity attempts authentication across disparate internal subnets inside a sub-minute window.

Egress and tunneling anomalies are the third signal. In Snowball the agent used Sliver C2 behind Cloudflare, suo5 HTTP multiplexing, custom replacement tunnels and Unicode-escaped JSP webshells. Inspecting east-west traffic for persistent, high-entropy HTTP chunked-transfer sessions, which are characteristic of suo5-style proxies, and auditing servlet containers for unexpected .jsp compilation events or Unicode-escaped file writes gives defenders a high-fidelity chokepoint against lateral persistence.

Finally, look for asynchronous execution artifacts. The healthcare domain controller dump left a recognizable pattern: temporary heartbeat files created and deleted in quick succession, watchdog polling loops in PowerShell, and non-interactive script execution used to stage NTDS.dit or registry hive extractions.

Technical debt is the real vulnerability

Cybersecurity has a comforting myth that every major breach comes from an equally sophisticated technical breakthrough. When an organization loses millions of healthcare records or suffers a full domain compromise, executives would rather tell boards and regulators that an unstoppable, futuristic AI weapon hit them.

Snowball removes that excuse. The DeepSeek-V4.1-Flash agent was an impressive piece of engineering. Holding an entire enterprise topology in a one-million-token window while rebuilding Liferay exploit chains and writing custom tunnels is a real step forward in offensive tooling. Yet the two-week campaign rested on preventable, mundane negligence.

The perimeter fell to CVE-2026-20320, a known and patchable XXE vulnerability in Cisco BroadWorks. Lateral movement worked because an internal Liferay server still carried CVE-2020-7961, disclosed and patched six years ago, and because eighty Zabbix backup configurations and plaintext database credentials sat where a compromised application server could read them. The breach of millions of patient, vaccination and appointment records happened because an InterSystems TrakCare database ran on an obsolete Oracle 9i engine on AIX with unchanged default administrator passwords, reachable across internal routing boundaries from the telecom hosting environment. Even the discovery of the campaign came down to basic hygiene: the attacker forgot to put a password on their own HTTP directory.

What autonomous agents change is the margin for error. For decades enterprise security teams have relied on security through exhaustion. They knew about their unpatched legacy servers, flat internal networks, forgotten backups full of cleartext passwords and ancient databases with default credentials. They survived because human attackers have finite time, attention and budgets. Finding one Oracle 9i database tucked behind thirteen hosted environments took hours of tedious scanning, note-taking and trial-and-error pivoting. Most opportunistic attackers would not sustain that effort, and elite human APT teams saved it for high-priority geopolitical targets.

That buffer is gone. An agent running on a one-million-token window with a sub-gigabyte KV cache costs pennies an hour, never forgets a hostname, executes 1,500 commands an hour, and is driven by a scoring harness to hunt every firewall console and legacy listener until the network map is exhausted. You cannot out-wait or out-hide a machine that reads every configuration file in milliseconds and treats every unpatched 2020 CVE and every 2001 default password as free points on a leaderboard.

How to defend against autonomous AI intrusions

Surviving autonomous intrusion does not call for a shiny new AI-powered defense platform to fight the attacker’s AI. It calls for the unglamorous engineering work enterprises have deferred for twenty years. That means eradicating default credentials at every tier of the stack and enforcing strict network segmentation with zero-trust micro-perimeters, so a compromised telecom host cannot reach a healthcare database listener. It means deploying endpoint telemetry on legacy Unix and appliance systems that teams assumed were unreachable, and decommissioning or isolating twenty-five-year-old database engines.