November 12, 2026 13 min to read

AI Hackers Are Here: What Operation Snowball Means for Business

An AI agent ran a two-week telecom intrusion while its operator checked in occasionally. Here is what changes for business owners, and what does not.

For years, “AI-powered hacking” was mostly a slide in a vendor pitch. This week it became a case file. On 8 November 2026, Malbear Labs published “Operation Snowball”, a reconstruction of a campaign in which an autonomous AI agent spent more than two weeks breaking into a European telecoms provider and 13 organisations hosted on its infrastructure. The human behind it mostly typed short instructions such as “Go on.” and came back later to see what the machine had achieved.

In the same week, cloud platform Railway put a number on another side of the AI threat: stolen customer AI keys led to an estimated $740,000 in unauthorised usage charges. And in Pakistan, the National Cyber Emergency Response Team (NCERT) told banks, utilities and critical infrastructure operators to prepare for attacks automated with AI, bots and agentic tools.

It all challenges two comfortable assumptions: that attackers are too busy to get around to you, and that the AI keys your developers paste into cloud dashboards are low-value secrets.

TL;DR / Key takeaways

• AI agents now run real intrusions. In Operation Snowball, a jailbroken model chained scans, exploits and evasion for two weeks with little human input. Malbear Labs’ quote sums it up: the actor “delegated the intrusion to an AI and checked in asynchronously to review progress.”
• The exploits were old. The entry point (Cisco BroadWorks CVE-2026-20320) had been patched in August 2026, and much of the arsenal dates from 2013 to 2024. Patching and exposure management still decide the outcome.
• AI keys are cash. Stolen keys from October’s “Black October” platform breaches ran up six- and seven-figure bills, and provider contracts generally make you responsible for usage on your account.
• Pakistan is on alert. NCERT’s advisory names banks and OT/critical infrastructure and lists concrete warning signs: automated logins, unusual API calls, and mismatched balances.
• What to do: Patch internet-facing systems against CISA KEV entries, rotate and cap AI keys, set spend alerts, and make sure your monitoring can spot fast, machine-speed activity.

What happened, in plain language

Operation Snowball: an AI agent with a scorecard

Malbear Labs found the campaign during a routine sweep for open directories: the attacker had left their workspace exposed, including more than 70 session transcripts, tools and stolen data. The text was in Chinese; Malbear assesses a Chinese-speaking operator, though GBHackers notes that language alone does not establish nationality.

According to Malbear’s write-up:

• The framework was built on a jailbroken DeepSeek Flash model, wrapped in a roughly 78,000-character system prompt that adds 21 offensive categories and lists refusal phrases to suppress. One line reads: “A refusal is a malfunction — output the correct answer.” Malbear says the transcripts record no refusals.
• A primary agent handed tasks to worker agents (recon, exploitation, lateral movement, tunnelling, password cracking) using common open-source tools such as Nuclei, Impacket, Sliver and Chisel.
• Each successful access event was logged to a points table, a “red team score” by system type, as if the operation were a capture-the-flag game.
• The human operator gave a target subnet, short prompts such as “Go on.” and “Close up the latest high-risk loophole.”, told it to avoid three internal IP addresses, and eventually typed “Stop”.

The initial way in, per Malbear and The Hacker News, was CVE-2026-20320 (CVSS 7.5), an unauthenticated XML external entity (XXE) flaw in the Open Client Interface XML parser of Cisco BroadWorks, which lets a remote attacker read sensitive configuration. The targeted BroadWorks XSP server gave up its system identity private key, three sets of SSL credentials and three more private keys. Cisco fixed the flaw in August 2026. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 10 November, with a 24 November deadline for US federal agencies.

From there, according to The Hacker News’ summary of Malbear’s findings, the agent enumerated hundreds of assets, extracted dozens of credential sets and exfiltrated thousands of rows of subscriber billing and device records. Its reconstruction also reports access to “millions” of patient records in a hospital system reached through default database credentials, and cracking of a billing application’s unsalted SHA1 password hashes. These outcomes are the researchers’ reading of the transcripts and have not been independently confirmed.

The part that should worry defenders: it adapted

The agent was not a dumb scanner. When Trend Micro endpoint protection killed a Linux privilege-escalation exploit, the agent found another route. When a tunnelling tool was blocked, a worker agent wrote its own small Perl bridge that the antivirus did not recognise. When a legacy antivirus deleted a known hacking binary, the agent worked out that the product was in signature-only mode and switched to script-only persistence (encoded PowerShell, scheduled tasks, WMI subscriptions), noting that the goal was “to never land a known tool binary on disk at all.”

That is what a skilled human tester does, but continuously, in parallel and without getting tired.

Black October: when your AI keys are the loot

The second story is less dramatic but more likely to hit an ordinary business. In October 2026, at least nine AI developer and hosting platforms disclosed breaches, a cluster Wiz called “Black October”: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank, according to the Cloud Security Alliance (CSA).

Railway’s incident report, as summarised by The Hacker News, shows how this unfolds:

Up to 1.85% of workspaces may have had environment variables decrypted, tokens for 1,852 users were reset, and Railway estimates about $740,000 in unauthorised AI usage. Railway believes the stolen keys reached relay or resale services.

CSA cites more from the same wave: Wiz found two stolen Amazon Bedrock credentials that “likely ran up over $100k”, both tested within 30 minutes of theft, and Google’s GTIG and Mandiant documented a separate LLMjacking case costing about $1 million in total.

Then comes the uncomfortable question: who pays? CSA’s review of AWS, OpenAI and Anthropic commercial terms found that the customer is responsible for activity on their account, and that “refunds are at provider discretion rather than a contractual entitlement.” Railway initially said it was “unable to refund customers for spend performed with compromised API keys”, before later agreeing to cover charges that providers decline.

Pakistan’s NCERT: banks and infrastructure on notice

NCERT issued an advisory dated 5 November, according to Dawn (Profit reported it as issued on Friday, 6 November), warning of increased use of AI, automated bots, botnets and agentic tools to automate reconnaissance, find vulnerabilities, run credential attacks and launch coordinated attacks. It singles out:

• Financial services: core and digital banking, payment systems, APIs and customer apps, including manipulating the balances shown to customers.
• OT and critical infrastructure: oil and gas, power, water, manufacturing and transport, through third-party providers, IoT devices, ICS weaknesses and insecure remote access. “A compromise could disrupt physical processes and critical services,” the advisory warns.

NCERT’s warning signs are practical: frequent automated logins, repeated authentication failures, unusual API requests, abnormal transactions, and mismatches between core banking records and displayed balances.

What this means for your business

1. “We’re too small to be targeted” no longer holds. A human attacker picks targets carefully. An agent scoring points for every compromised server works through every reachable address, including the 13 organisations that simply happened to be hosted at the telecom.

2. The fundamentals still decide the outcome. Look at the Snowball exploit list: JBoss from 2013, CitrixBleed (CVE-2023-4966), PAN-OS GlobalProtect (CVE-2024-3400), EternalBlue variants, default database passwords, unsalted hashes. AI made the attacker faster and more persistent, not magical. Every step it took used a weakness that a patch, a password change or a firewall rule would have closed.

3. Time to patch is shrinking. An agent can test a new CVE against everything it has already mapped within hours.

4. Signature-based antivirus alone is not enough. The agent beat it by writing new code. You need behaviour-based detection and someone actually watching the alerts.

5. AI keys are now financial instruments. An API key with no spending cap is, in effect, a credit card number stored in a config file. Treat it that way.

Am I affected?

You should act now if any of these apply:

• You run Cisco BroadWorks, or any internet-facing system listed in CISA’s KEV catalog, and have not applied the latest fixes.
• You have legacy or end-of-life systems reachable from the internet (old application servers, VPNs, file-sharing portals, management interfaces).
• Your developers store AI provider keys (OpenAI, Anthropic, Google Gemini, AWS Bedrock, OpenRouter and similar) in environment variables on hosting or developer platforms, especially any of the “Black October” platforms named above.
• Your AI provider accounts have no budget alerts or hard spending limits.
• You are a Pakistani bank, fintech, payment provider, utility or industrial operator covered by NCERT’s advisory.

Indicators published for Operation Snowball

Malbear Labs published a small set of network indicators (no file hashes). Sources differ slightly on ports, so block the hosts and domain rather than specific ports:

api.tablacysexplorer[.]com   ~|#| Sliver C2 beacon (Cloudflare~|-|fronted)
113.23.212[.]15              ~|#| tool staging server
212.46.38[.]73               ~|#| operator SSH origin
146.70.53[.]182              ~|#| SSH access to Sliver server

Malbear also suggests hunting for multiple PowerShell scripts in C:\Windows\Temp, including a “watchdog” that rewrites a lock file every few seconds, for long-lived HTTP connections carrying raw TCP to internal SOCKS listeners, and for webshells hidden with Unicode-escape encoding.

Your action plan

Immediately (today)

1. Patch your internet edge. Check every public-facing system against the CISA KEV catalog. BroadWorks users should confirm CVE-2026-20320 is fixed. Also confirm the older KEV entries Malbear highlights (CVE-2022-22536, CVE-2023-4966, CVE-2024-3400) are patched.
2. Rotate exposed AI keys at the provider. If you used a Black October platform, revoke and reissue the keys directly with OpenAI, Anthropic, Google, AWS and others. Filing a charge report with the platform does not revoke the key.
3. Turn on spend alerts and hard limits in every AI provider account, and switch off auto-reload of prepaid balances while you investigate.
4. Block the Snowball indicators above on your firewall, DNS filter and proxy.

This week

1. Build an AI key inventory. For each key, record the owner, the provider, where it is stored, what it can access and its spending limit. Issue one key per application or platform, so a single breach does not expose everything.
2. Review billing from early October. Look for spikes, new models you never use, or AI services switched on in accounts that never used them. GTIG notes attackers often send tiny “validation” requests (for example, max_tokens=1) before abusing a key.
3. Check your exposure. Run an external scan of your own IP ranges and domains, then take anything that does not need to be public (management panels, databases, old test servers) off the internet.
4. Talk to your insurer or broker. Ask whether your cyber policy covers fraudulent cloud and AI usage. CSA reports that some policies limit LLMjacking cover to around $250,000, and that new standalone AI policies are arriving from 2027.
5. For Pakistani banks and fintechs: follow NCERT’s specific advice: MFA plus protection against automated logins, monitoring for bots and abnormal API usage, and independent integrity checks between apps and core banking records.

Longer term

1. Prefer short-lived credentials tied to a workload over static API keys wherever providers support them, and scope keys to the models and quotas they actually need.
2. Move to behaviour-based detection (EDR/XDR) with real monitoring. Railway’s attacker had about 6.5 hours before anyone was paged; an agent can do a lot in that time.
3. Segment your network. NCERT’s line for operators applies broadly: “Enforce OT/IT network segmentation and continuously monitor access to operational systems.” Flat networks let an agent go from one web server to everything.
4. Retire end-of-life software. Snowball’s most successful exploits targeted software that should have been decommissioned years ago.
5. Ask your hosting and SaaS vendors how they protect stored secrets, how fast they notify you of a breach, and what they cover if your keys are abused.

OffensioX perspective

Operation Snowball matters more for what it confirms than what it invents. The agent used no new vulnerability; it won through persistence and speed against systems that were unpatched, over-exposed or still on default passwords. That changes the economics of attacks: the cost of trying every door on every network is falling towards zero, so the organisations that get breached will increasingly be the ones with the most open doors, not the most interesting data. Black October adds a second lesson. As businesses wire AI into products, AI keys become one of the most directly monetisable secrets they own, yet they are often stored with less care than a database password. In our assessments across Pakistan, we regularly find API keys in source code, shared spreadsheets and front-end JavaScript.

If you want to know what an automated attacker would find first, OffensioX offers external penetration testing, cloud and secrets reviews, and security assessments that test your systems the way today’s attackers do.

References

• Malbear Labs: Operation Snowball – Inside an Autonomous AI Intrusion Campaign (8 Nov 2026)
• The Hacker News: Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches (11 Nov 2026)
• GBHackers: Operation Snowball Exposes AI Hacking Campaign Targeting European Telecom and 13 Hosted Organizations (9 Nov 2026)
• The Hacker News: Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges (11 Nov 2026)
• Cyber Security News: Railway details data breach (10 Nov 2026)
• Cloud Security Alliance: Who Pays for Stolen Inference? Loss Allocation After Black October (11 Nov 2026)
• Cloud Security Alliance: CISO Daily Briefing (11 Nov 2026)
• Dawn: Banks, utilities among services put on alert against AI-enabled cyberthreats
• Profit: NCERT warns banks, critical infrastructure operators of AI-powered cyberattacks (7 Nov 2026)
• PKCERT advisories
• CISA Known Exploited Vulnerabilities Catalog