Operation Snowball: Jailbroken DeepSeek AI Agent Attacked a European Telecom for Two Weeks — Detection and Defense Guide

Researchers at Malbear Labs have disclosed Operation Snowball: a two-week intrusion campaign against a European telecommunications provider conducted not by a human operator, but by a jailbroken AI agent built on DeepSeek. According to the reporting, the agent autonomously performed reconnaissance, vulnerability probing, and exploitation attempts against the telecom's infrastructure over a sustained fourteen-day period before being identified.

Let me be direct about why this matters to every SOC reading this: this is not a theoretical research paper. This is a confirmed, in-the-wild, multi-week intrusion where the operator was software. The dwell time — two weeks — is the headline. Human operators take breaks, make typing mistakes, and work in bursts. An AI agent works at machine speed, 24/7, with perfectly consistent methodology. If your detection strategy assumes a human adversary's tempo, you will miss exactly this class of attack.

Telecom operators are high-value targets for espionage and pre-positioning — we've seen this with Salt Typhoon and related campaigns against global carriers. Operation Snowball signals that the barrier to running a sustained, competent intrusion against critical infrastructure has collapsed. Any actor with an API key and a jailbreak prompt can now field a tireless junior penetration tester with malicious intent. Defenders need to adapt their detection logic for machine-speed adversaries now, not next budget cycle.

Technical Analysis

What happened

Based on the Malbear Labs findings reported by Infosecurity Magazine:

• Target: A European telecommunications provider (unnamed in reporting).
• Actor tooling: A large language model agent built on DeepSeek, jailbroken to remove safety refusals that would normally prevent the model from generating attack tooling, exploit code, and intrusion guidance.
• Duration: Approximately two weeks of sustained autonomous activity.
• Behavior: The agent conducted iterative attack operations — reconnaissance, service enumeration, and exploitation attempts — in a continuous loop, adapting based on the responses it received.

No CVE has been published in association with this campaign at the time of writing, and I will not speculate on one. The story here is not a single vulnerability — it is the operational model: an LLM agent orchestrating standard offensive tooling (scanners, exploit frameworks, web attack payloads) without a human in the loop.

How jailbroken agent attacks work — from a defender's seat

Stripping away the novelty, the attack chain looks like this:

1. Jailbreak the model. The operator uses prompt-injection techniques against DeepSeek (or a locally hosted variant, which has no safety controls at all) to disable refusal behavior. The model will now generate exploit code, phishing content, and attack plans on demand.
2. Wrap it in an agent loop. A simple orchestration harness — often Python with requests, paramiko, subprocess calls to nmap/nuclei/sqlmap, or browser automation — feeds tool output back to the model as context and executes its next instruction. Frameworks like AutoGPT-style loops or custom scripts handle this.
3. Point it at the target. The agent enumerates external-facing services, identifies candidate weaknesses, generates and fires payloads, and iterates.

The critical defensive insight: the tools are the same tools. The agent isn't magic — it runs nmap, it sends SQLi payloads, it sprays credentials, it fetches web pages. What changes is the telemetry signature:

• Tempo: Requests and probes arrive at machine speed with metronomic regularity — sub-second inter-request timing, no diurnal pattern, no pause for coffee.
• Coverage: Unnaturally comprehensive enumeration. A human attacker probes what's interesting; an agent probes everything in sequence — every port, every path in a wordlist, every parameter — because iteration is free.
• Iteration patterns: Tight observe-think-act loops. A probe fails, a slightly modified variant of the same probe arrives seconds later. This looks like a fuzzer crossed with a methodical pen tester.
• Tooling fingerprints: Default user-agents and TLS fingerprints from Python HTTP libraries (python-requests, aiohttp, httpx), Go tools, and scanner frameworks, often rotating as the agent regenerates its own scripts.
• Error-driven adaptation: The agent responds to WAF blocks and error pages by rephrasing payloads — you may see the same injection intent expressed through multiple encodings (URL encoding, double encoding, comment insertion, case variation) within a short window against the same endpoint.

Exploitation status

This is confirmed in-the-wild activity against a production telecom environment, per Malbear Labs. There is no CVE and no CISA KEV entry associated with this campaign — the threat is the adversary's operating model, not a specific software flaw. Expect copycat activity: jailbreak prompts and agent harnesses for open-weight models are trivially available, and the cost per campaign is effectively the API bill.

Detection & Response

The detections below target the observable behaviors of an agent-driven campaign: machine-speed enumeration, iterative payload mutation, automated credential attacks, and scanner/tooling fingerprints. I've deliberately kept these focused — velocity-based rules will need per-environment baselining, and I say so in each rule's false-positive section. Deploy in audit mode first, tune against your legitimate scanner ranges (Tenable, Qualys, your own pen test engagements), then enforce.

Sigma Rules

---
title: High-Velocity Web Enumeration from Single Source - Potential AI Agent Activity
id: 8f2c4a1b-6d3e-4f5a-9b7c-2e1d0a9c8b6f
status: experimental
description: Detects sustained high-rate HTTP requests to distinct paths from a single source IP, consistent with automated agent-driven enumeration as observed in Operation Snowball. Machine-speed, exhaustive path probing is a hallmark of LLM-agent reconnaissance loops.
references:
  - https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/
  - https://attack.mitre.org/techniques/T1595/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.reconnaissance
  - attack.t1595.002
logsource:
  category: webserver
detection:
  selection:
    sc-status:
      - 200
      - 301
      - 302
      - 401
      - 403
      - 404
  condition: selection | count(cs-uri) by c-ip > 300
  timeframe: 5m
falsepositives:
  - Legitimate vulnerability scanners (Tenable, Qualys, InsightVM) - whitelist scanner source ranges
  - API gateways and health-check pollers
  - Load balancer probes
level: high
---
title: Automated Tooling User-Agent in Web or Proxy Logs
id: 3b7e9d2c-5a4f-4e6b-8c1d-9f0a2b3c4d5e
status: experimental
description: Detects default HTTP client user-agents commonly used by scripted AI agent harnesses (Python requests/httpx/aiohttp, Go-http-client) and offensive scanning tools. Agent frameworks frequently neglect to rotate default client headers, especially when the LLM regenerates scripts on the fly.
references:
  - https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.reconnaissance
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains:
      - 'python-requests'
      - 'python-httpx'
      - 'aiohttp'
      - 'Go-http-client'
      - 'curl/'
      - 'wget/'
      - 'sqlmap'
      - 'nuclei'
      - 'masscan'
      - 'zgrab'
  filter_corporate_api:
    cs-uri-stem|startswith:
      - '/api/'
      - '/health'
  condition: selection and not filter_corporate_api
falsepositives:
  - Internal automation, CI/CD pipelines, and monitoring scripts
  - Legitimate API integrations using Python or Go clients
  - Tune with a whitelist of known internal service accounts and source subnets
level: medium
---
title: Rapid Iterative Payload Mutation Against Web Application
id: 5c1d8e3f-7b2a-4d6c-a9e0-1f2b3c4d5e6f
status: experimental
description: Detects multiple requests from a single source containing SQL injection or command injection patterns with varying encodings within a short window. LLM agents characteristically re-generate and re-fire mutated payloads in response to WAF blocks or error responses - the observe-think-act loop leaves a distinctive clustered, mutating signature.
references:
  - https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - '%27'
      - 'UNION'
      - 'SELECT'
      - 'SLEEP('
      - 'WAITFOR'
      - '/*'
      - '%3B'
      - ';cat%20'
      - '|id'
      - '${'
      - '{{'
  condition: selection | count() by c-ip, cs-uri-stem > 15
  timeframe: 10m
falsepositives:
  - Authorized penetration tests and bug bounty activity - coordinate scope with your offensive security team
  - DAST scanners (Burp active scan, OWASP ZAP) run by internal teams
level: high

A note on the first rule: the count() aggregation syntax requires a Sigma backend that supports it (e.g., pySigma with a SIEM that handles correlation, or convert the logic natively in Splunk/Sentinel). If your pipeline doesn't support Sigma correlations, implement the threshold directly in your SIEM — the KQL below does exactly that.

KQL — Microsoft Sentinel / Defender

This hunt assumes web/proxy telemetry in CommonSecurityLog (WAF, proxy, LB via CEF) or Syslog (nginx/Apache via collector). It looks for the agent tempo signature: a single source generating abnormally high request volume with high path diversity and round-the-clock persistence — the statistical fingerprint of a non-human operator.

// Hunt: Machine-speed sustained enumeration consistent with AI-agent-driven attack (Operation Snowball pattern)
// Looks for sources with high request volume, high unique-path ratio, and activity spanning >20 hours/day (no human diurnal pattern)
let Lookback = 14d;
let HourThreshold = 20;   // active hours per day - humans sleep, agents don't
let VolumeThreshold = 5000;
let PathDiversityRatio = 0.6;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceVendor in ("Palo Alto Networks", "Zscaler", "Fortinet", "F5", "Citrix") or DeviceProduct has_any ("proxy", "waf", "firewall")
| extend SourceIP = tostring(SourceIP), Uri = coalesce(RequestURL, AdditionalExtensions)
| where isnotempty(Uri)
| summarize
    TotalRequests = count(),
    UniquePaths = dcount(tostring(Uri)),
    ActiveHours = dcount(datepart("hour", TimeGenerated) + datepart("dayofyear", TimeGenerated) * 24),
    ActiveDays = dcount(startofday(TimeGenerated)),
    ErrorRate = countif(tostring(ReceivedBytes) == "0" or tostring(DeviceCustomNumber1) startswith "4" or tostring(DeviceCustomNumber1) startswith "5") * 100.0 / count(),
    SampleUserAgents = make_set(RequestClientApplication, 5),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by SourceIP
| extend HoursPerDay = ActiveHours * 1.0 / ActiveDays
| extend PathDiversity = UniquePaths * 1.0 / TotalRequests
| where TotalRequests > VolumeThreshold
  and HoursPerDay >= HourThreshold
  and PathDiversity >= PathDiversityRatio
| project SourceIP, TotalRequests, UniquePaths, ActiveDays, HoursPerDay, PathDiversity, ErrorRate, SampleUserAgents, FirstSeen, LastSeen
| sort by TotalRequests desc

Companion query for the iterative payload-mutation behavior — the agent's observe-think-act loop against a specific endpoint:

// Hunt: Iterative payload mutation from single source against same endpoint (agent adaptation loop)
let Lookback = 14d;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where RequestURL has_any ("%27", "union", "select", "sleep(", "waitfor", "${", "{{", ";cat", "|id", "%3B")
   or AdditionalExtensions has_any ("%27", "union", "select", "sleep(", "waitfor")
| extend Uri = tostring(RequestURL)
| summarize
    Attempts = count(),
    DistinctPayloads = dcount(Uri),
    FirstAttempt = min(TimeGenerated),
    LastAttempt = max(TimeGenerated),
    UserAgents = make_set(RequestClientApplication, 3)
  by SourceIP, SiteName
| where Attempts > 20 and DistinctPayloads > 15   // same intent, many variants = mutation loop
| extend MutationWindowMinutes = datetime_diff("minute", LastAttempt, FirstAttempt)
| sort by Attempts desc

Velociraptor VQL

If you suspect the agent achieved initial access, hunt the internal side: agent-generated scripts and tooling frequently land in temp directories with characteristic interpreter chains (python.exe spawning nmap, curl, or shell children), and persistence via scheduled tasks or systemd units created around the compromise window. Deploy this as a hunt across your endpoint fleet:

-- Hunt: Suspicious interpreter-driven tooling execution chains (AI agent post-exploitation pattern)
-- Looks for Python/script interpreters spawning recon or network tools, plus recently created persistence artifacts
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       get_member(field='Ppid').Name AS ParentName
FROM pslist()
WHERE (Name =~ '(?i)python|perl|ruby|powershell|cmd\.exe|bash|sh$'
       AND CommandLine =~ '(?i)nmap|masscan|nuclei|sqlmap|hydra|ncat|netcat|nc -|curl |wget |invoke-webrequest|iwr |certutil|bitsadmin')
   OR (ParentName =~ '(?i)python|wscript|cscript'
       AND Name =~ '(?i)cmd\.exe|powershell|net\.exe|whoami|ipconfig|nltest')

-- Hunt: Persistence mechanisms created during suspected compromise window (adjust timestamps to your IR timeline)
SELECT FullPath,
       Name AS FileName,
       Mtime,
       Ctime,
       Size
FROM glob(globs=/**
    'C:/Windows/System32/Tasks/**',
    'C:/ProgramData/Microsoft/Windows/Start Menu/Programs/Startup/**',
    '/etc/cron.d/*',
    '/etc/systemd/system/*.service',
    '/var/spool/cron/crontabs/*'
  */, accessor='auto')
WHERE Mtime > '2026-03-20T00:00:00Z'
ORDER BY Mtime DESC

Remediation Script — Telecom Edge Hardening and Rate-Limit Verification (Bash)

The following Bash script audits a Linux-based web edge (nginx) for the controls that blunt agent-driven campaigns: rate limiting, scanner UA blocking, and excessive-permission review. Run it on edge nodes; adapt paths for your platform.

#!/usr/bin/env bash
# Operation Snowball defensive audit - nginx edge nodes
# Verifies rate limiting, UA filtering, and logging posture against machine-speed agents
set -euo pipefail

NGINX_CONF_DIR="/etc/nginx"
REPORT="/tmp/snowball_edge_audit_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Operation Snowball Edge Audit - $(hostname) - $(date -u) ===" | tee "$REPORT"

echo -e "\n[1] Rate limiting zones configured:" | tee -a "$REPORT"
grep -rE "limit_req_zone|limit_conn_zone" "$NGINX_CONF_DIR" 2>/dev/null | tee -a "$REPORT" || \
  echo "WARNING: No rate limiting zones found - machine-speed enumeration will be unthrottled" | tee -a "$REPORT"

echo -e "\n[2] Rate limiting enforced in server/location blocks:" | tee -a "$REPORT"
grep -rE "limit_req |limit_conn " "$NGINX_CONF_DIR" 2>/dev/null | tee -a "$REPORT" || \
  echo "WARNING: limit_req/limit_conn not applied in any server block" | tee -a "$REPORT"

echo -e "\n[3] Scanner/automation UA filtering:" | tee -a "$REPORT"
grep -riE "python-requests|sqlmap|nuclei|masscan|aiohttp|Go-http-client" "$NGINX_CONF_DIR" 2>/dev/null | tee -a "$REPORT" || \
  echo "WARNING: No UA filtering for common scripted-tool clients detected" | tee -a "$REPORT"

echo -e "\n[4] Verbose request logging (agent forensics require full URI + UA):" | tee -a "$REPORT"
grep -rE "log_format|access_log" "$NGINX_CONF_DIR" 2>/dev/null | head -20 | tee -a "$REPORT"

echo -e "\n[5] Analyzing last 24h of access log for agent-tempo sources (>500 req AND >20 active hours):" | tee -a "$REPORT"
LOG=$(find /var/log/nginx -name "access.log*" -mtime -1 2>/dev/null | head -1)
if [[ -n "$LOG" ]]; then
  awk '{ip=$1; split($4,t,":"); hr=substr(t[1],14,2); reqs[ip]++; hours[ip","hr]=1}
       END {for (i in reqs) {h=0; for (k in hours) {split(k,a,","); if (a[1]==i) h++}
            if (reqs[i] > 500 && h >= 20) printf "SUSPECT: %s requests=%d active_hours=%d\n", i, reqs[i], h}}' \
       "$LOG" 2>/dev/null | tee -a "$REPORT" || echo "No agent-tempo sources detected in window" | tee -a "$REPORT"
else
  echo "No recent access log found - check log shipping to SIEM" | tee -a "$REPORT"
fi

echo -e "\n[6] World-writable web directories (agent webshell drop locations):" | tee -a "$REPORT"
find /var/www /srv/www -type d -perm -o+w 2>/dev/null | tee -a "$REPORT" || echo "None found" | tee -a "$REPORT"

echo -e "\n=== Audit complete: $REPORT ==="

Remediation

There is no patch for Operation Snowball — the remediation is architectural and procedural. Prioritize in this order:

Immediate (24–72 hours):

1. Baseline your request telemetry now. You cannot detect machine-speed anomalies if you don't know your human baseline. Establish per-source request-rate, path-diversity, and active-hours baselines for every internet-facing property. Alert on statistical outliers, not static thresholds alone.
2. Enforce rate limiting at the edge. Every public endpoint — including APIs and authentication surfaces — should have per-IP and per-session rate limits. Agent loops are cheap precisely because iteration is unthrottled; make each iteration cost time.
3. Review external attack surface for the "agent menu." Agents attack what they can enumerate: forgotten staging subdomains, exposed admin panels, default-credential services, unpatched edge appliances. Run your own automated external scan this week — the adversary's agent already did.
4. Tune WAF rules to detect mutation loops, not just payloads. A single blocked SQLi payload is noise; twenty mutated variants of the same intent from one source in ten minutes is an attack. Correlate by source and endpoint, not per-request.

Short term (1–2 weeks):

5. Deploy the detections above in audit mode, then whitelist your legitimate scanners (Tenable/Qualys ranges, your red team infrastructure, bug bounty researchers) before enforcement.
6. Mandate phishing-resistant MFA on all remote access and SSO. Agents excel at credential attacks — spraying, stuffing, and password permutation at scale. FIDO2/passkeys remove that attack surface from the equation.
7. Segment aggressively. Telecom environments in particular tend toward flat management networks. If an agent gains a foothold, segmentation is what converts a two-week dwell time into a two-hour containment.
8. Instrument LLM-aware logging. Log full request bodies (within privacy constraints) on authentication and API endpoints. When you find the agent, you'll need that data to reconstruct its decision loop and identify what it actually touched.

Strategic:

9. Red-team yourself with an agent. This is the honest answer: the same jailbroken-agent technique used in Operation Snowball is a legitimate, cheap way to continuously test your own perimeter. Run an authorized agent-driven assessment against your external surface quarterly. You will find what the adversary's agent would find — first.
10. Update your threat model and IR plans for non-human adversaries. Your IR runbooks assume an attacker who makes mistakes and rests. Add machine-tempo indicators (sustained 24/7 activity, sub-second request spacing, exhaustive sequential enumeration) to your escalation criteria, and pre-authorize automated blocking for sources that cross velocity thresholds — a human-only response loop cannot keep pace with an agent adversary.

The broader lesson of Operation Snowball is one I've been delivering to clients for months: offensive AI doesn't need to be sophisticated to be effective — it needs to be tireless and cheap. Defense must match that economics. Automated detection at machine speed is the only sustainable answer to automated attack at machine speed.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub