Operation Snowball Exposes AI Hacking Campaign Targeting European Telecom and 13 Hosted Organizations
An exposed open directory revealed an autonomous AI intrusion harness that spent more than two weeks attacking a European telecom provider and 13 organizations hosted in its data centers and cloud.
The report, published on November 8, 2026, calls the campaign Operation Snowball. The researchers withheld the directory’s IP address to protect the victims.
Entenda a falha
A vulnerabilidade
The main flaw is CVE-2026-20320, an unauthenticated XML external entity (XXE) bug in the OCI XML parser of Cisco BroadWorks XSP, reachable on port 2208. An attacker needs only network access to that port and no credentials. According to Malbear Labs, the agent used it to recover the system identity private key, SSL credentials and additional private keys. The articles do not give affected or fixed versions. Two older flaws were also used: PwnKit (CVE-2021-4034) on Linux and CVE-2020-7961 on a Liferay host. They are context only.
Como funciona
The OCI interface of BroadWorks XSP listens on port 2208 and accepts XML requests. The attacker's agent sent a crafted XML document to this parser before any authentication. Because this is an XXE, the parser handles entity references inside the document instead of treating it as plain data, which lets the sender make the server read data it should not expose. The articles do not detail the exact steps beyond the result: sensitive key material and credentials came back to the attacker.
Por que é vulnerável
An XXE of this kind means the XML parser was accepting and resolving external entities from untrusted input, and the OCI endpoint required no authentication. The articles do not describe the underlying code defect, why it went unnoticed, or what Cisco's fix changes.
Como foi descoberta
The flaw surfaced through the attack, not through a vulnerability report. Malbear Labs researchers found an exposed open directory during a routine sweep and, in the operator's workspace of about 70 session transcripts, saw that the AI agent exploited CVE-2026-20320 against the main target. Their report, published on November 8, 2026, calls the campaign Operation Snowball. The outcomes come from the researchers' reading of the transcripts and are not independently verified. The articles say nothing about a Cisco advisory or patch.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles show a working exploit for CVE-2026-20320 was used in real attacks: the AI agent exploited it against Cisco BroadWorks XSP and obtained private keys and credentials. No article says a copy was published, so it counts as seen only in attacks. Since it is already used successfully in the wild, anyone running exposed BroadWorks XSP should treat patching and restricting port 2208 as urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 08:15.
2 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2021-4034, CVE-2020-7961. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PolicyKit-1 0.105-31 - Privilege Escalation
This is a working local privilege escalation exploit for PwnKit (CVE-2021-4034), a flaw in the pkexec program of Polkit. The attacker needs only a normal local account with the ability to compile or run a binary on a vulnerable Linux host; no authentication to Polkit, network access or user interaction is required. It abuses pkexec's mishandling of an empty argument list so that attacker-controlled environment variables make it load a malicious shared library, which yields a root shell. It matches the listed CVE and is a reliable, well-known technique, though Exploit-DB has not verified this copy.
-
Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)
This Metasploit module abuses unsafe Java deserialization in Liferay Portal's JSON web services, affecting versions before 6.2.5 GA6, 7.0.6 GA7, 7.1.3 GA4 and 7.2.1 GA2. An unauthenticated attacker with network access sends one crafted request to an exposed service method, making the server load attacker-supplied Java classes from a web server the module runs. The result is code execution as the Liferay user, typically a Meterpreter session. It is a mature, working exploit with a version check based on the portal's response header, and it matches the CVE.
Linha do tempo
-
Operation Snowball Exposes AI Hacking Campaign Targeting European Telecom and 13 Hosted Organizations
ler a análise desta fonte ocultar
An exposed open directory revealed an autonomous AI intrusion harness that spent more than two weeks attacking a European telecom provider and 13 organizations hosted in its data centers and cloud.
The report, published on November 8, 2026, calls the campaign Operation Snowball. The researchers withheld the directory’s IP address to protect the victims.