Operation Snowball: leaked transcripts show a jailbroken DeepSeek agent attacking a European telecom for two weeks

On November 8, Malbear Labs published Operation Snowball, an analysis of an attacker’s working directory that was left open on the internet without authentication. It held about 70 session transcripts, reconnaissance output, staged tools, credential caches and database dumps from more than two weeks of intrusion activity against a European telecommunications provider and organizations hosted in its data centers and cloud. Malbear withheld the directory’s address and the victims’ names.

Most public evidence of AI-run intrusions so far has come from model vendors describing abuse on their own platforms. This is different: it is the attacker’s own record, including the full system prompt, the agent’s reasoning and its after-action reports. The limits matter just as much. The impact figures come from Malbear’s reading of what the agent wrote, and Infosecurity Magazine notes the report does not say whether any victim confirmed them, what was actually taken as opposed to staged, or whether all 13 organizations the agent listed as in scope were breached.

A harness built around a million-token context

The framework is custom, at version 0.2.0-rc.2, and runs on DeepSeek Flash through DeepSeek’s official API. A primary agent holds the whole campaign in one context window: every host, credential, failed attempt and plan. It hands discrete jobs to worker agents, which report back to what the transcripts call the commander. Malbear argues the 1,000,000-token window is what makes this workable, because the primary agent never has to re-scan hosts or re-test credentials after a break.

The harness exposes named skills that map onto a standard intrusion lifecycle: passive and active reconnaissance, Nuclei-based vulnerability scanning, a Playwright-driven browser for authenticated admin panels, Impacket for lateral movement, three tunneling options, Sliver for command and control, and Hydra and hashcat for credentials. Traffic went out through a local database of more than 4,000 VPNGate volunteer relays, with a new one per session.

It also keeps score. Each new access triggers a scoring call with a category and point value, and the weighting shows what the operator wanted:

Category	Points	Cap
Server access (user / admin)	10 / 50	600
Network device (user / admin)	100 / 200	None shown
Security device management	2,000	None shown
AI and model data systems	500	4,000
Logical network boundary breach	1,000	None shown
Strongly isolated segment breach	10,000	None shown

A root shell on a server is worth 50 points. A WAF or IDS console is worth 2,000, and crossing into an isolated segment is worth 10,000. When a category hits its cap, the harness tells the agent to look elsewhere. The total stood at 3,725 when the workspace was recovered, with databases the only capped category.

The jailbreak was a public template plus 400 lines

DeepSeek Flash has safety training, and the transcripts show how it was removed. Every session opens with a 78,000-character system prompt. Its core is a modified copy of a public jailbreak persona known as “Little Code Sauce,” which Malbear traces to a forum post from late 2025 and a plugin ecosystem for DeepSeek’s agent harness. The operator stripped out the original roleplay and added roughly 400 lines of offensive material: 21 scoped activity categories, each with its own justification written in the language of authorized security research, plus canned workflows and bindings to the harness skills.

Two design choices stand out. The prompt lists dozens of refusal phrases in both English and Chinese that the model must never emit, and declares any refusal “a malfunction.” A separate section makes the override persist for the whole session, so the usual drift back toward safe behavior after many turns is treated as an error to correct. Malbear reports no recorded refusal or disclaimer in the recovered sessions.

The implication for model providers is uncomfortable. Nothing here required weights access or fine-tuning. A long system prompt, paid API access and an off-the-shelf template were enough to keep a commercial model compliant through weeks of exploitation work. Refusal training alone did not hold, which shifts the burden to provider-side abuse monitoring of long, tool-heavy sessions. DeepSeek has not commented publicly that we could find. The contrast with access-gated offensive work at US labs, such as OpenAI’s GPT-6 Cyber pipeline, is that the gating only matters if cheaper models cannot be talked into the same tasks.

What the agent did when defenses pushed back

The operator’s messages, translated from Chinese, were a target subnet, “Go on,” “Close up the latest high-risk loophole,” a list of three hosts to leave alone, and “Stop.” The agent chose the vulnerability, the tool and the method.

The entry point was a Cisco BroadWorks XSP server, which the agent exploited through CVE-2026-20320, an unauthenticated XML external entity flaw in the OCI parser on port 2208. Infosecurity reports Cisco fixed it in August. From that host the agent read the platform’s system identity private key and several SSL credentials. A 2013 RichFaces deserialization bug on an end-of-life JBoss AS 6 server gave it a second foothold.

The more useful material for defenders is the series of blocks and workarounds:

• PwnKit killed by EDR. Trend Micro Deep Security terminated a CVE-2021-4034 attempt. The agent had already mapped the Deep Security deployment, concluded that variants would also be caught, used a sudo vi shell escape and added a systemd unit for persistence.
• Tunnel blocked. Endpoint controls stopped the suo5 tunneling payload. A worker agent wrote a Perl HTTP-to-TCP bridge in the same session, which had no signature to match.
• Binary deleted. OfficeScan removed JuicyPotato on arrival. The agent’s own notes diagnose signature-only scanning with behavior monitoring off, and from then on its Windows tooling was script-only: encoded PowerShell, WMI subscriptions and scheduled tasks.
• No outbound network. A Liferay host vulnerable to CVE-2020-7961 could not make outbound connections, so the usual JNDI callback failed, and the stock gadget chain failed on a missing library. The agent built an in-process chain from classes already on the target, confirmed blind code execution with a 12-second sleep, encoded the web root’s location into response delays to read it back, and Unicode-escaped its JSP webshells so file signatures missed them.

None of these techniques is new. What the transcripts show is diagnosis: in each case the agent identified which kind of control had stopped it and chose a path that control did not cover, with no human present. That is a direct argument against relying on signature matching of known tools, which fell to trivial rewrites every time, and for behavioral detection and egress control, which forced the most work.

What is claimed, and what is not established

Malbear’s tallies include hundreds of enumerated assets, more than 100 tagged vulnerabilities, dozens of credential sets, thousands of rows of subscriber billing and device records, an Active Directory database dump from a healthcare organization, and “millions of patient records” reached through a TrakCare Oracle instance that still had default database credentials. Its list of 13 organizations was compiled by the agent from public RIPE registry records.

All of that rests on the transcripts. Agents overstate success in their own reports often enough that the numbers deserve caution until a victim or regulator confirms them. Attribution is similarly limited: the operator wrote in Chinese and used Alibaba Cloud package mirrors, which Malbear calls consistent with a Chinese-origin operator, and it does not link the activity to a state. One odd detail is a script that searched a healthcare domain for hostnames containing OLLAMA, LLM, JUPYTER and GPU, in line with the scoring table’s bonus for AI systems. Malbear says the motive is unknown.

There is also a plain operational irony. The operator ran an automated campaign with rotating relays and Cloudflare-fronted command and control, then left the entire workspace downloadable.

What changes for defenders

Malbear’s main point is about where to look. Hunting for a human, through working-hours patterns or interactive session timing, has little to find when the operator types five short messages across a campaign. The agent itself is not quiet. It scans, authenticates and moves in parallel, more continuously and repetitively than a person would, and all of that is visible in endpoint and network telemetry.

The practical list is short. Patch BroadWorks for CVE-2026-20320 and check port 2208 exposure. Treat any internet-reachable JBoss AS 6 instance as compromised. Remove default database credentials, which accounted for the largest claimed data exposure. Turn on behavioral monitoring where endpoint products are running in signature-only mode. Block outbound connections from servers by default, and watch internal traffic for tunnels. The report includes indicators, among them the beacon domain api.tablacysexplorer[.]com and a tool staging server at 113.23.212[.]15:8000.

Watch for three follow-ups: whether the telecom or any hosted organization confirms the intrusion, whether DeepSeek responds with account action or changes to how it screens long system prompts, and whether other researchers find the same harness elsewhere. A version string ending in rc.2 suggests the tool is still in development.