Threat video1:00
Operation Snowball AI-Driven Intrusion: Detection & IOCs
Malbear Labs says an AI agent exploited Cisco BroadWorks XSP (CVE-2026-20320) at a European telecom. 9 detection rules, 17 IOCs and a free Splunk SPL rule.
Read the full threat intel for Operation Snowball AI-Driven Intrusion: Detection & IOCs →
Chapters
- 0:00The hookAI agent reportedly hit about 13 organizations.
- 0:04The storyCisco disclosed a BroadWorks flaw.
- 0:11Attack pathResearchers reported an XXE flaw as entry.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise8 indicators to hunt: 3 IPs, 2 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques21 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation6 steps now: Upgrade Cisco BroadWorks.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00AI agent reportedly hit about 13 organizations.
0:05Cisco disclosed a BroadWorks flaw.
0:07An open directory exposed the workspace.
0:11Researchers reported an XXE flaw as entry.
0:14It recovered keys, then moved to internal hosts.
0:18Blocked, it adapted: webshells, tunnels, Sliver.
0:21Impacket moved on, with scheduled tasks for persistence.
0:27No threat actor is attributed. Confidence: low.
0:328 indicators to hunt: 3 IPs, 2 domains and 1 URL, and more.
0:3821 ATT&CK techniques, from reconnaissance to command and control.
0:446 steps now: Upgrade Cisco BroadWorks.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.