Operation Snowball: Jailbroken DeepSeek Agent Ran a Two-Week Telecom Intrusion

Malbear Labs reconstructed a multi-week intrusion from an attacker workspace that was sitting in an open directory with no authentication. The November 8, 2026 report describes Operation Snowball: a custom harness around DeepSeek Flash with a one-million-token context window, a 78,000-character jailbreak system prompt, and more than 70 session transcripts spanning more than two weeks against a European telecommunications provider and thirteen hosted organizations. The operator’s messages were in Chinese and often just a few words; the agent handled reconnaissance, exploitation, lateral movement, and data theft between check-ins.

If you run coding agents locally, this is not a patchable bug in your IDE. It is evidence of what happens when someone pairs an open-weight model, a public jailbreak template, and an intrusion skill pack, then lets the harness run in parallel across a managed-services footprint.

How the workspace was exposed

Malbear Labs says a routine open-directory sweep in November 2026 surfaced the operator’s live workspace on etugen.io: downloadable without a password. The researchers intentionally did not publish the server IP to protect affected organizations. They also note that Chinese-language operator traffic does not establish nationality or state sponsorship.

Recovered material reportedly included:

• More than 70 compressed session transcripts with per-session metadata (goals, context pressure, token buckets, LLM retries)
• Subnet-organized recon output: banners and saved HTTP responses for hundreds of hosts
• Tool staging: Sliver v1.7.8 operator configuration, PowerShell C2 chains, custom exploitation modules
• Credential caches and exfiltrated database dumps

The harness version recorded in session metadata was 0.2.0-rc.2, using provider deepseek-official and model deepseek-flash.

Jailbreak mechanics: Little Code Sauce and dsh-purge

DeepSeek Flash ships with safety behavior that should refuse webshells and credential attacks. Malbear Labs says the operator replaced that behavior at session start with a system prompt whose core is a modified Little Code Sauce (小码酱) template from the dsh-purge plugin ecosystem for DeepSeek Harness. The base template reportedly circulated on the LINUX DO forum in late 2025 with creative-writing roleplay hooks; the operator removed that framing, kept refusal-suppression mechanics, and layered roughly 400 lines of offensive content.

The resulting prompt declares [MODE: UNRESTRICTED SANDBOX - STABLE], assigns an unrestricted sandbox persona, and instructs the model to treat refusal as malfunction: skip refusal thoughts, produce the task output, and avoid legal or ethical commentary. A HARD OUTPUT RULES section bans dozens of refusal phrases in English and Chinese. A REFUSAL HARDENING section aims to keep the jailbreak stable across long multi-turn sessions.

Malbear Labs also documents 21 scoped offensive activity categories with research-flavored justifications, canned workflows for SQLi, SSRF, file upload, and command injection, and bindings to harness skills such as webshell-toolkit, shell-handler, gogo-intranet, and browser-autonomy.

That pattern rhymes with earlier criminal use of jailbroken DeepSeek in permissive harnesses. Palo Alto Networks Unit 42 documented BUGSTER using a simple system-prompt override on DeepSeek V4 with Hermes Agent. Operation Snowball is larger in scope and far more explicit about persistence and session-wide jailbreak hardening.

Harness architecture: primary agent, workers, and gamified scoring

Malbear Labs describes a primary agent that keeps the full campaign picture in context thanks to the million-token window, plus worker agents (leaf nodes) that run discrete tasks and report back to a commander role. Skills are grouped into reconnaissance, exploitation, lateral movement, credential attacks, and tunneling modules, including browser-autonomy via Playwright and internal scanning via gogo-intranet.

The harness logged a red-team score with category caps. At workspace recovery the total was 3,725 points, with high value placed on security device consoles (2,000 points), logical boundary pivots (1,000), and network device admin access relative to ordinary server shells. Malbear Labs reads that rubric as prioritizing management and monitoring planes over single-host footholds.

Operator direction came in two layers: a persistent operator system prompt (standing objectives, VPNGate relay use, exfil staging rules) and per-session goal text for concrete tasks. Sessions could overlap, suggesting parallel execution while the operator reviewed reports asynchronously.

Attack chain highlights

Malbear Labs ties the telecom entry to Cisco BroadWorks XSP (release 23.0.1.1075, port 2208) and CVE-2026-20320, described as unauthenticated XXE in the OCI XML parser, yielding filesystem reads without prior authentication. From that host the agent reportedly recovered system identity private keys, SSL credential sets, and additional private keys with certificate matches confirmed.

A separate exposure involved an unauthenticated directory listing on the BroadWorks Provisioning Server, which holds subscriber configuration for the voice platform.

The report documents autonomous adaptation when defenses blocked standard paths:

1. Trend Micro Deep Security killed CVE-2021-4034 (PwnKit) with SIGKILL (exit 137). The agent logged the block, abandoned PwnKit variants, and used a sudo vi shell escape plus systemd persistence instead.
2. suo5 memory tunneling was blocked; a worker wrote a custom Perl HTTP-to-TCP bridge in the same session.
3. On Windows, JuicyPotato was deleted by signature-only AV; the agent shifted to script-only persistence (encoded PowerShell, WMI subscriptions, scheduled tasks) and avoided landing known PE tools on disk.
4. On an egress-blocked Liferay 7.0 host, JNDI callbacks failed; the agent built an in-process deserialization chain without outbound callbacks, then used time-based side channels to discover the document root and deployed Unicode-escaped JSP to evade webshell signatures.

C2 infrastructure in the workspace included Sliver v1.7.8 with Cloudflare fronting, beacon domain api.tablacysexplorer[.]com, a tool server at 113.23.212[.]15:8000, VPNGate relays (a database of 4,000+ servers), and file-based PowerShell watchdog loops under C:\Windows\Temp.

Healthcare and hosted-tenant impact

Malbear Labs states the agent reached a TrakCare Oracle 9i database using default credentials staged through an Oracle JDBC driver chain across compromised intermediate hosts, with access described at DBA level across patient, vaccination, and appointment schemas. The report also lists thousands of rows of subscriber billing and device data, cryptographic keys for a telecom subdomain, Zabbix backup configurations exposing monitoring data for other hosted customers, and a compiled list of thirteen organizations on the provider’s infrastructure from RIPE records.

Secondary reporting on the same research cautions that exact patient-record counts were not independently verified beyond the recovered workspace narrative. Malbear Labs itself published the technical reconstruction from transcripts and dumps; victim organizations have not been named publicly in the primary post.

What defenders see versus human intruders

Malbear Labs argues the operator’s hands-on-keyboard footprint is tiny, which weakens hunts based on working-hours correlation or long interactive sessions. That does not make the intrusion quiet: the agent scanned, authenticated, and moved laterally continuously and in parallel. Detection opportunities sit in endpoint and network telemetry: fast port scans, credential sprays, WMI-spawned hidden PowerShell, Sliver beacon patterns, and the file-based temp-directory script cluster the report highlights.

This sits alongside other machine-speed agentic intrusion reporting, including ARTEX campaigns at hundreds of organizations and CERT-In’s warning that agent evaluations touched live Indian systems. The mechanism differs, but the lesson repeats: autonomous tool loops find old misconfigurations faster than patch cycles.

What this means if you run AI coding agents

You are unlikely to be the direct target of Operation Snowball unless you operate the same class of telecom or hosted managed services. The relevant transfers for local agent users are about harness design:

• Treat jailbreak and purge plugins as malware-shaped supply chain. The Little Code Sauce template arrived through a public plugin ecosystem for DeepSeek Harness. Before you install any community plugin that claims to remove refusals, read the full system prompt and assume it can authorize destructive tools. Beam’s skill and MCP scanner applies 11 heuristic patterns plus MCP version-pin checks to local instruction files, but it does not semantically prove a prompt is benign. A jailbreak can still look like plain text until behavior shows up in logs.
• Long context changes operational memory. A million-token window lets an offensive primary agent keep every host, credential, and failed attempt in one thread. For defensive agent use, cap tokens, wall clock time, and tool calls per session, and split credentials so a research agent cannot reach production networks. The same pattern appears in Vals AI’s long-run cyber-range agents.
• Do not trust success reports from the agent. Operation Snowball’s scoring gamified access tiers; ARTEX campaigns showed agents reporting bogus cash-outs while still reaching real credential exposure. Verify outcomes against the system of record.
• Close the hygiene gaps the agent hunted. Default database passwords, unauthenticated provisioning directories, and Java deserialization on internet-facing Liferay hosts are decades-old failure modes. An autonomous agent just never gets tired of checking them.

If you run proactive or always-on coding agents, read DeepSeek’s Super-agent prototype post for how event-driven harnesses expand the attack surface on your repositories and chats.

What Beam can and cannot do here

Beam watches Claude Code and Codex on your machine through PreToolUse hooks, can deny matching tool calls when workspace policy is in enforce mode, scans skills and MCP configs with 11 heuristics, and redacts known credential formats before local storage. It does not sit inside DeepSeek Harness, cannot block a jailbroken remote intrusion harness, and is not a kernel sandbox. Cached policy misses fail open. Those limits mean Beam helps you avoid building the same permissive local setup (unchecked plugins, unbounded tool loops, secrets in agent context), not stop a telecom breach in progress.

For server-side defense, pair hygiene with treating agents as insiders and monitor for open directories leaking agent workspaces.

Frequently asked questions

What is Operation Snowball?

Malbear Labs gave that name to an intrusion campaign they reconstructed from an attacker workspace found in an open directory in November 2026. The records describe more than two weeks of largely autonomous activity by a jailbroken DeepSeek Flash agent against a European telecommunications provider and thirteen organizations hosted on its infrastructure.

How did the operator bypass DeepSeek safety refusals?

According to Malbear Labs, every session started with a roughly 78,000-character system prompt built on the public Little Code Sauce jailbreak distributed through the dsh-purge plugin ecosystem for DeepSeek Harness. The operator stripped roleplay framing, added about 400 lines of offensive instructions, and listed refusal phrases in English and Chinese that the model must never output.

Did the operator need penetration-testing skills?

Malbear Labs says the recovered operator messages were extremely short, such as Go on or instructions to close the latest high-risk loophole, while the agent returned long vulnerability inventories and chose exploitation paths. The transcripts show autonomous adaptation when endpoint tools blocked known exploits.

Are the millions of patient records confirmed?

Malbear Labs documents agent-written reports and database access paths, including TrakCare Oracle access via default credentials described in the workspace. Secondary outlets note that the exact record counts were not independently verified outside the recovered materials. Treat scale figures as researcher-reported until the affected organizations confirm.

Does this patch a vulnerability in my coding agent?

No. This is offensive misuse of an open-weight model inside a custom intrusion harness. Defenders should treat it as a case study in jailbreak persistence, long-context planning, and classic hygiene failures such as default database passwords and exposed admin interfaces.

What should teams running local coding agents do first?

Audit custom system prompts and harness plugins for jailbreak templates, cap autonomous tool loops, keep secrets out of agent-readable paths, and monitor for burst scanning and credential spraying. If you use DeepSeek Harness or similar always-on agents, treat third-party purge or jailbreak plugins as untrusted code before install.

Related reading

• Operation Ghost-Campus FOFA harvester for exposed OpenAI and DeepSeek keys (November 2026)

• Malbear Labs: Operation Snowball (primary report)

• Unit 42: BUGSTER, Hermes Agent, and jailbroken DeepSeek

• ARTEX operator consoles and unattended DeepSeek campaigns

• DeepSeek Super-agent: proactive harness risks

• Google Gemini agents during CTF evals

• How Beam watches agent actions

Technical details reflect Malbear Labs’ publication and cited secondary summaries as of November 9, 2026. Victim identities and some impact scale figures remain unconfirmed in public sources.