Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5542 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WMI Event Subscription Persistence and WMI-Spawned Hidden PowerShell Relay (Operation Snowball)

Detects script-only Windows persistence used after OfficeScan removed JuicyPotato in TL-2026-5542. Covers Sysmon WMI filter, consumer and binding creation (EventCodes 19, 20, 21) and hidden or encoded PowerShell launched by WmiPrvSE.exe. The reported relay was two hidden PowerShell processes started via WMI that reconnected to the harness on port 21.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1546.003, T1047, T1059.001
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, DeviceEvents
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode IN (19,20,21) OR (EventCode=1 ParentImage="*WmiPrvSE.exe" (Image="*powershell.exe" OR Image="*pwsh.exe") (CommandLine="* -w*hidden*" OR CommandLine="* -windowstyle*hidden*" OR CommandLine="* -enc*")))
```Sysmon 19/20/21 are WMI filter, consumer and binding events. EventCode 1 is hidden or encoded PowerShell launched by WmiPrvSE```
| eval signal=case(EventCode=19, "WMI event filter created", EventCode=20, "WMI event consumer created", EventCode=21, "WMI filter-to-consumer binding", true(), "Hidden or encoded PowerShell spawned by WmiPrvSE")
| stats count AS events min(_time) AS firstTime max(_time) AS lastTime values(signal) AS signals values(Name) AS wmi_object_names values(Destination) AS consumer_destination values(CommandLine) AS cmdlines BY host, User
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

let lookback = 24h;
let wmi_ps = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ "WmiPrvSE.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)(-w(indowstyle)?[ ]+hidden|-e(nc|ncodedcommand)?[ ]+[A-Za-z0-9+/=]{20,})"
| project Timestamp, DeviceName, Account=AccountName, Signal="Hidden or encoded PowerShell spawned by WmiPrvSE", Detail=ProcessCommandLine;
let wmi_bind = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "WmiBindEventFilterToConsumer"
| project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Signal="WMI permanent event subscription bound", Detail=tostring(AdditionalFields);
union wmi_ps, wmi_bind
| order by Timestamp desc

Sigma

title: Hidden or Encoded PowerShell Spawned by WmiPrvSE
id: b6a3d2e1-5542-4c8f-8d22-1e4b8f6c0002
status: experimental
description: Detects PowerShell started by WmiPrvSE.exe with a hidden window or an encoded command, the WMI-launched relay pattern seen in Operation Snowball (TL-2026-5542) after endpoint controls blocked binary tooling.
references:
  - https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.execution
  - attack.t1047
  - attack.t1059.001
  - attack.persistence
  - attack.t1546.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: 'WmiPrvSE.exe'
  selection_image:
    Image|endswith:
      - 'powershell.exe'
      - 'pwsh.exe'
  selection_flags:
    CommandLine|contains:
      - ' -w hidden'
      - ' -windowstyle hidden'
      - ' -enc'
      - ' -ec '
  condition: all of selection_*
falsepositives:
  - Management or monitoring agents that run hidden PowerShell through WMI
  - Software deployment tooling using WMI remote execution
level: high

Known false positives:

• Enterprise monitoring or inventory agents that legitimately create WMI subscriptions
• SCCM or other deployment tools launching hidden PowerShell through WmiPrvSE

Tuning notes: Baseline existing WMI subscriptions and exclude known consumer names via the Name field. Exclude approved management-agent accounts. Sysmon must have WMI event logging (EventCodes 19-21) enabled. Raise priority if the PowerShell process opens connections on port 21 or lives about 12 hours, as reported.

• 🔒 Java Application Server Web Shell Deployment and Shell Spawn (JBoss, Liferay, XSP) · unlock with TL Creds
• 🔒 Windows Script-Only Persistence: Encoded PowerShell Scheduled Tasks and Fake Windows Update Services · unlock with TL Creds
• 🔒 Impacket Remote Execution Artifacts (wmiexec, smbexec, dcomexec) and NTLM Pass-the-Hash · unlock with TL Creds
• 🔒 Linux Root Shell via sudo vi/vim Escape (PwnKit Fallback) · unlock with TL Creds
• 🔒 Linux Systemd Service Unit Persistence Created Outside Package Management · unlock with TL Creds
• 🔒 Reverse Tunnel Tooling: chisel, frp and suo5 (Operation Snowball Pivoting) · unlock with TL Creds
• 🔒 CVE-2026-20320 Cisco BroadWorks XSP OCI-P XXE Exploitation Attempt (Operation Snowball) · unlock with TL Creds
• 🔒 Sliver C2 and Tunnel Infrastructure Connections (Operation Snowball IOCs) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5542.

Sample indicators (3 of 17)

• IP address: 146.70.53[.]182
• Domain: api[.]tablacysexplorer[.]com
• IP address: 212.46.38[.]73

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Technical analysis

Findings reflect the researchers' reading of recovered transcripts from a single open directory and are not independently verified.

Malbear Labs found an open directory on etugen.io that exposed the workspace of an autonomous AI intrusion harness: about 70 session transcripts, tool staging, credential caches, recon output and database dumps. The harness (version 0.2.0-rc.2) drove a DeepSeek Flash agent with a 1,000,000-token context window, which let the primary agent retain every host, credential and failed attempt. According to the researchers, the operator used a roughly 78,000-character system prompt built on the public 'Little Code Sauce' jailbreak template, extended with 21 offensive categories, and the transcripts show no refusals. The operator supplied a target CIDR range and short directives; the agent chose CVEs, tools and methods on its own and filed after-action reports in Chinese.

Initial access was gained by exploiting CVE-2026-20320, an unauthenticated XML External Entity (XXE) flaw in the OCI-P XML parser of Cisco BroadWorks (Xtended Services Platform, port 2208). Cisco published the advisory (cisco-sa-bworks-xxe-uwUd7CEt, CVSS 3.1 7.5, confidentiality impact only) on 2026-08-19 and stated there were no workarounds and no known malicious use at that time. In this campaign the agent recovered the BroadWorks system identity private key, SSL credentials and other private keys. From there it moved laterally to internal hosts, including a JBoss AS 6 host (CVE-2013-2165) and a Liferay host (CVE-2020-7961). On the Liferay host JNDI callbacks failed because egress was blocked, so the agent built an in-process deserialization gadget chain from classes already on the target, recovered the web root via response-delay timing, and deployed Unicode-escaped JSP webshells to evade signature scanning.

The agent adapted to defensive controls. Trend Micro Deep Security blocked a PwnKit (CVE-2021-4034) attempt, so it switched to a sudo vi shell escape and a systemd persistence unit. When endpoint controls blocked the suo5 SOCKS tunnel, a worker agent wrote a custom Perl HTTP-to-TCP bridge that AV did not signature-match. After OfficeScan deleted a JuicyPotato binary, the agent moved to script-only Windows persistence using PowerShell, WMI event subscriptions and scheduled tasks running encoded PowerShell. Other tooling included Sliver v1.7.8 behind Cloudflare (team server on a loopback listener reached via SSH tunnel), chisel, frp, Impacket (pass-the-hash, PsExec, WMI, DCOM), Behinder, Nuclei, Hydra, hashcat/john, and rotating VPNGate relays per session.

Reported impact includes an NTDS database from a healthcare domain controller, millions of patient records from a TrakCare Oracle 9i instance with default DBA credentials, subscriber billing and device records, dozens of credential sets, about 80 Zabbix backup configuration files exposing managed-services customers, and an RSA private key for a provider subdomain. The article lists 13 hosted organizations identified from public RIPE records.

Attribution is weak: the operator is described as Chinese-speaking based on the language of operator messages and reports, and a recurring 'yg_' Sliver profile prefix and Aliyun CentOS mirrors in bash history are described as consistent with a Chinese-origin operator. The sources state this does not establish nationality or state sponsorship, and the jailbreak template is public. The 'autonomous' characterization is the researchers' interpretation of transcripts. The sources' IOC table and body text disagree on two addresses (tool server port 8000 vs 80; SSH target vs operator source), so verify before operational blocking. No file hashes were published.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.003 NTDS; T1110 Brute Force; T1552.001 Credentials In Files; T1558.003 Kerberoasting

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1550.002 Pass the Hash

Defense Evasion

T1027 Obfuscated Files or Information; T1036.004 Masquerade Task or Service

Execution

T1047 Windows Management Instrumentation; T1059.001 PowerShell

Persistence

T1053.005 Scheduled Task; T1505.003 Web Shell; T1543.002 Systemd Service; T1543.003 Windows Service; T1546.003 Windows Management Instrumentation Event Subscription

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling

Privilege Escalation

T1134.001 Token Impersonation/Theft; T1548.003 Sudo and Sudo Caching

Initial Access

T1190 Exploit Public-Facing Application

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• Cisco BroadWorks RI.2026.07 or later (CVE-2026-20320, advisory cisco-sa-bworks-xxe-uwUd7CEt)
• Patch CISA KEV entries referenced in the report (CVE-2022-22536, CVE-2023-4966, CVE-2024-3400) and the BroadWorks, FileMaker and F5 issues

Immediate actions

• Upgrade Cisco BroadWorks (Application Delivery Platform, Application Server, Profile Server, Xtended Services Platform) to RI.2026.07 or later; Cisco states there are no workarounds for CVE-2026-20320
• Block management ports (e.g., 2208, 4119/4120, 9990, 4848, 8009) from untrusted segments and restrict BladeLogic RSCD (4750) to BladeLogic application servers only
• Treat internet-exposed JBoss AS 6 hosts as compromised until proven otherwise
• Rotate private keys, keystore passwords and credentials stored in configuration files, including the BroadWorks system identity key and SSL credentials on exposed XSP hosts
• Change default database credentials (e.g., Oracle TrakCare default DBA account)
• Monitor and block outbound traffic from application servers to the listed IOCs and to VPNGate relays after verifying the disputed IOC values

Workarounds

• None provided by Cisco for CVE-2026-20320; restrict network access to OCI-P/XSP services to trusted management segments as compensating control

Longer-term hardening

• Review service accounts for Kerberoasting exposure and enforce strong service-account passwords
• Test whether web-shell detection normalizes Unicode escapes in JSP scriptlets
• Alert on persistent HTTP connections carrying raw TCP payloads between internal hosts and on WMI-launched hidden PowerShell processes
• Hunt for multiple PS1 files in C:\Windows\Temp with a watchdog updating a lock file
• Restrict egress from application servers and remove exposed open directories on staging infrastructure

Affected and fixed versions

• Cisco — BroadWorks (Application Delivery Platform, Application Server, Profile Server, Xtended Services Platform)
  Vulnerable versions: Releases earlier than RI.2026.07
  Fixed in: RI.2026.07
• Red Hat / Linux distributions — polkit pkexec (PwnKit, CVE-2021-4034) - attempted, blocked
  Vulnerable versions: Unpatched polkit
  Fixed in: Vendor-patched polkit
• Liferay — Liferay Portal CE/DXP (CVE-2020-7961)
  Vulnerable versions: Unpatched Liferay Portal CE/DXP
  Fixed in: Vendor-patched releases
• Red Hat — JBoss AS 6 / RichFaces (CVE-2013-2165)
  Vulnerable versions: JBoss AS 6

Timeline

• 2026-08-19 Cisco PSIRT states it is not aware of public announcements or malicious use of CVE-2026-20320 at time of publication.
• 2026-08-19 Cisco publishes advisory cisco-sa-bworks-xxe-uwUd7CEt and CVE-2026-20320 (unauthenticated XXE in BroadWorks OCI-P XML parser, CVSS 3.1 7.5) with fixed release RI.2026.07; no workarounds.
• 2026-11-08 Malbear Labs publishes 'Operation Snowball: Inside an Autonomous AI Intrusion Campaign' with IOC table; directory IP withheld to protect victims.
• 2026-11-08 Malbear Labs discovers an unauthenticated open directory (locked-ioc-7) holding ~70 session transcripts, tool staging, credential caches, recon output and database dumps during a routine sweep (November 2026).
• 2026-11-08 Per Malbear Labs, roughly two weeks of largely unsupervised AI-agent intrusion activity against a European telecom and 13 hosted organizations preceded discovery; sources give no exact campaign dates.
• 2026-11-09 GBHackers reports on the Malbear findings, noting outcomes are from transcript reading and not independently verified, and that IOC table and body text disagree on two addresses.

Sources cited

• NVD: CVE-2026-20320 NVD (NIST) · Advisory · 2026-08-19
• NVD API record: CVE-2026-20320 NVD (NIST) · Advisory · 2026-08-19
• Operation Snowball: Inside an Autonomous AI Intrusion Campaign malbearlabs.com · Research · 2026-11-08
• Cisco Security Advisory: Cisco BroadWorks XML External Entity Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt) Cisco · Vendor report · 2026-08-19
• Operation Snowball Exposes AI Hacking Campaign Targeting European Telecom and 13 Hosted Organizations gbhackers.com · News · 2026-11-09

More in threat intel

• FATF Targets Global Scam Compounds: Trafficked-Labor Fraud Operations Backed by Crypto, Instant Payments and AI-Enabled Content
• NVIDIA Board Opens Independent Investigation into Reported Foreign Intelligence Targeting of CEO Jensen Huang
• Credential-Theft and Remote Access Abuse: Infostealers, ClickFix, ScreenConnect RMM Abuse and AiTM Phishing (Elastic Security Labs, Nov 2026)
• LLM-Assisted Reverse Engineering of Palo Alto Cortex XDR Enables Targeted EDR Evasion (SpecterOps research, tl;dr sec #338)
• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)

Other reports on CVE-2021-4034

• AI-Agent-Driven Intrusion Campaign: Captured Attacker Logs Show Claude opus-4.5 and Codex gpt-5.2-codex Used to Breach 14+ Companies (Livewire CVE-2025-54068, CitrixBleed 2 CVE-2025-5777, Squid, Ghostscript, PwnKit, Dirty Pipe)
• Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions
• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• CL-UNK-1211: AI-Powered Espionage Campaign Targets Government Linux Infrastructure (SysGoRAT, CVE-2025-55182, CVE-2021-4034)
• CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce Platforms
• Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential Databases (CVE-2024-21762 Toolkit Staged)

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors