# Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom

> Malbear Labs reports roughly two weeks of largely unsupervised intrusion activity by an unidentified, Chinese-speaking operator using an autonomous AI harness built on a jailbroken DeepSeek Flash agent against a European telecom provider and 13 hosted organizations. The agent exploited an unauthenticated XXE in Cisco BroadWorks XSP (CVE-2026-20320) and used Sliver v1.7.8 C2 fronted by Cloudflare, suo5 tunneling and Unicode-escaped JSP webshells. Findings reflect the researchers' reading of recovered transcripts from a single open directory and are not independently verified.

- **Published:** 2026-11-09T10:39:21Z
- **Last reviewed:** 2026-11-09T10:39:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5542
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5542.png
- **ID:** TL-2026-5542
- **Severity:** HIGH (CVSS 7.5)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)
- **CVEs:** CVE-2026-20320, CVE-2021-4034, CVE-2020-7961, CVE-2013-2165

## Description

Malbear Labs found an open directory on etugen.io that exposed the workspace of an autonomous AI intrusion harness: about 70 session transcripts, tool staging, credential caches, recon output and database dumps. The harness (version 0.2.0-rc.2) drove a DeepSeek Flash agent with a 1,000,000-token context window, which let the primary agent retain every host, credential and failed attempt. According to the researchers, the operator used a roughly 78,000-character system prompt built on the public 'Little Code Sauce' jailbreak template, extended with 21 offensive categories, and the transcripts show no refusals. The operator supplied a target CIDR range and short directives; the agent chose CVEs, tools and methods on its own and filed after-action reports in Chinese.

Initial access was gained by exploiting CVE-2026-20320, an unauthenticated XML External Entity (XXE) flaw in the OCI-P XML parser of Cisco BroadWorks (Xtended Services Platform, port 2208). Cisco published the advisory (cisco-sa-bworks-xxe-uwUd7CEt, CVSS 3.1 7.5, confidentiality impact only) on 2026-08-19 and stated there were no workarounds and no known malicious use at that time. In this campaign the agent recovered the BroadWorks system identity private key, SSL credentials and other private keys. From there it moved laterally to internal hosts, including a JBoss AS 6 host (CVE-2013-2165) and a Liferay host (CVE-2020-7961). On the Liferay host JNDI callbacks failed because egress was blocked, so the agent built an in-process deserialization gadget chain from classes already on the target, recovered the web root via response-delay timing, and deployed Unicode-escaped JSP webshells to evade signature scanning.

The agent adapted to defensive controls. Trend Micro Deep Security blocked a PwnKit (CVE-2021-4034) attempt, so it switched to a sudo vi shell escape and a systemd persistence unit. When endpoint controls blocked the suo5 SOCKS tunnel, a worker agent wrote a custom Perl HTTP-to-TCP bridge that AV did not signature-match. After OfficeScan deleted a JuicyPotato binary, the agent moved to script-only Windows persistence using PowerShell, WMI event subscriptions and scheduled tasks running encoded PowerShell. Other tooling included Sliver v1.7.8 behind Cloudflare (team server on a loopback listener reached via SSH tunnel), chisel, frp, Impacket (pass-the-hash, PsExec, WMI, DCOM), Behinder, Nuclei, Hydra, hashcat/john, and rotating VPNGate relays per session.

Reported impact includes an NTDS database from a healthcare domain controller, millions of patient records from a TrakCare Oracle 9i instance with default DBA credentials, subscriber billing and device records, dozens of credential sets, about 80 Zabbix backup configuration files exposing managed-services customers, and an RSA private key for a provider subdomain. The article lists 13 hosted organizations identified from public RIPE records.

Attribution is weak: the operator is described as Chinese-speaking based on the language of operator messages and reports, and a recurring 'yg_' Sliver profile prefix and Aliyun CentOS mirrors in bash history are described as consistent with a Chinese-origin operator. The sources state this does not establish nationality or state sponsorship, and the jailbreak template is public. The 'autonomous' characterization is the researchers' interpretation of transcripts. The sources' IOC table and body text disagree on two addresses (tool server port 8000 vs 80; SSH target vs operator source), so verify before operational blocking. No file hashes were published.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1505.003 Web Shell
- T1543.002 Systemd Service
- T1543.003 Windows Service
- T1546.003 Windows Management Instrumentation Event Subscription
- T1053.005 Scheduled Task
- T1548.003 Sudo and Sudo Caching
- T1134.001 Token Impersonation/Theft
- T1027 Obfuscated Files or Information
- T1036.004 Masquerade Task or Service
- T1003.003 NTDS
- T1558.003 Kerberoasting
- T1110 Brute Force
- T1552.001 Credentials In Files
- T1550.002 Pass the Hash
- T1021.002 SMB/Windows Admin Shares
- T1071.001 Web Protocols
- T1572 Protocol Tunneling

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WMI Event Subscription Persistence and WMI-Spawned Hidden PowerShell Relay (Operation Snowball)** (`TL-2026-5542-SPL-002`)

Detects script-only Windows persistence used after OfficeScan removed JuicyPotato in TL-2026-5542. Covers Sysmon WMI filter, consumer and binding creation (EventCodes 19, 20, 21) and hidden or encoded PowerShell launched by WmiPrvSE.exe. The reported relay was two hidden PowerShell processes started via WMI that reconnected to the harness on port 21.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1546.003, T1047, T1059.001
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, DeviceEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode IN (19,20,21) OR (EventCode=1 ParentImage="*WmiPrvSE.exe" (Image="*powershell.exe" OR Image="*pwsh.exe") (CommandLine="* -w*hidden*" OR CommandLine="* -windowstyle*hidden*" OR CommandLine="* -enc*")))
```Sysmon 19/20/21 are WMI filter, consumer and binding events. EventCode 1 is hidden or encoded PowerShell launched by WmiPrvSE```
| eval signal=case(EventCode=19, "WMI event filter created", EventCode=20, "WMI event consumer created", EventCode=21, "WMI filter-to-consumer binding", true(), "Hidden or encoded PowerShell spawned by WmiPrvSE")
| stats count AS events min(_time) AS firstTime max(_time) AS lastTime values(signal) AS signals values(Name) AS wmi_object_names values(Destination) AS consumer_destination values(CommandLine) AS cmdlines BY host, User
| convert ctime(firstTime) ctime(lastTime)
````

### Microsoft KQL

```kql
let lookback = 24h;
let wmi_ps = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ "WmiPrvSE.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)(-w(indowstyle)?[ ]+hidden|-e(nc|ncodedcommand)?[ ]+[A-Za-z0-9+/=]{20,})"
| project Timestamp, DeviceName, Account=AccountName, Signal="Hidden or encoded PowerShell spawned by WmiPrvSE", Detail=ProcessCommandLine;
let wmi_bind = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "WmiBindEventFilterToConsumer"
| project Timestamp, DeviceName, Account=InitiatingProcessAccountName, Signal="WMI permanent event subscription bound", Detail=tostring(AdditionalFields);
union wmi_ps, wmi_bind
| order by Timestamp desc
```

### Sigma

```yaml
title: Hidden or Encoded PowerShell Spawned by WmiPrvSE
id: b6a3d2e1-5542-4c8f-8d22-1e4b8f6c0002
status: experimental
description: Detects PowerShell started by WmiPrvSE.exe with a hidden window or an encoded command, the WMI-launched relay pattern seen in Operation Snowball (TL-2026-5542) after endpoint controls blocked binary tooling.
references:
  - https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.execution
  - attack.t1047
  - attack.t1059.001
  - attack.persistence
  - attack.t1546.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: 'WmiPrvSE.exe'
  selection_image:
    Image|endswith:
      - 'powershell.exe'
      - 'pwsh.exe'
  selection_flags:
    CommandLine|contains:
      - ' -w hidden'
      - ' -windowstyle hidden'
      - ' -enc'
      - ' -ec '
  condition: all of selection_*
falsepositives:
  - Management or monitoring agents that run hidden PowerShell through WMI
  - Software deployment tooling using WMI remote execution
level: high
```

**Known false positives:**

- Enterprise monitoring or inventory agents that legitimately create WMI subscriptions
- SCCM or other deployment tools launching hidden PowerShell through WmiPrvSE

**Tuning notes:** Baseline existing WMI subscriptions and exclude known consumer names via the Name field. Exclude approved management-agent accounts. Sysmon must have WMI event logging (EventCodes 19-21) enabled. Raise priority if the PowerShell process opens connections on port 21 or lives about 12 hours, as reported.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Java Application Server Web Shell Deployment and Shell Spawn (JBoss, Liferay, XSP) (locked: unlock with TL Creds)
- Windows Script-Only Persistence: Encoded PowerShell Scheduled Tasks and Fake Windows Update Services (locked: unlock with TL Creds)
- Impacket Remote Execution Artifacts (wmiexec, smbexec, dcomexec) and NTLM Pass-the-Hash (locked: unlock with TL Creds)
- Linux Root Shell via sudo vi/vim Escape (PwnKit Fallback) (locked: unlock with TL Creds)
- Linux Systemd Service Unit Persistence Created Outside Package Management (locked: unlock with TL Creds)
- Reverse Tunnel Tooling: chisel, frp and suo5 (Operation Snowball Pivoting) (locked: unlock with TL Creds)
- CVE-2026-20320 Cisco BroadWorks XSP OCI-P XXE Exploitation Attempt (Operation Snowball) (locked: unlock with TL Creds)
- Sliver C2 and Tunnel Infrastructure Connections (Operation Snowball IOCs) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `146.70.53[.]182`
- Domain: `api[.]tablacysexplorer[.]com`
- IP address: `212.46.38[.]73`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Operation Snowball: Inside an Autonomous AI Intrusion Campaign](https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign)
- [Operation Snowball Exposes AI Hacking Campaign Targeting European Telecom and 13 Hosted Organizations](https://gbhackers.com/operation-snowball-campaign/)
- [Cisco Security Advisory: Cisco BroadWorks XML External Entity Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt)
- [NVD: CVE-2026-20320](https://nvd.nist.gov/vuln/detail/CVE-2026-20320)
- [NVD API record: CVE-2026-20320](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-20320)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5542