Operation Snowball: Malbear Labs' AI Intrusion Teardown

Malbear Labs has published one of the clearest looks yet at what an autonomous AI intrusion looks like from the inside. In Operation Snowball: Inside an Autonomous AI Intrusion Campaign (8 November 2026), the team describes finding the live workspace of an attack harness in an open directory: transcripts, tools, stolen data and the agents' own after-action reports. Everything below is Malbear's reporting, credited to them. PlayCISO has not verified it independently.

Why this research deserves credit

Most write-ups of AI-assisted attacks describe what an attacker could do. Malbear had the working files of one that was doing it, and used them carefully.

• They found it by routine work. An open-directory sweep, not a tip-off. The finding is a reminder of how much attacker tooling sits exposed, and that patient, ordinary threat hunting still pays.
• They read the primary source. Instead of speculating about agents, they worked through the transcripts: the session index, the skill inventory, the operator's messages and the scoring rubric. That is why the post can say how the system behaves, not just that it exists.
• They protected the victims. They did not publish the directory's address, because publishing it would have pointed anyone at the exposed data of the affected organisations.
• They translated and organised the evidence. The skill modules are laid out by intrusion phase and the rubric is tabulated, so a defender can map each part to a control.
• They drew the honest conclusion. The post argues the agent is not quieter than a human; it is noisier, and what it defeats is the hunt for a person. That is a useful correction to the "stealthy AI attacker" story.

What Malbear reports

The harness

Malbear describes a custom agent framework at version 0.2.0-rc.2, built around DeepSeek Flash. The point it stresses is scale: with a context window that large, the primary agent can hold the whole state of a multi-day intrusion at once, including every host found, every credential collected and every attempt and outcome. A primary agent keeps the master workspace and hands tasks to worker agents, which run to completion and report back.

Guardrails

The post says the model's refusals were removed by a very long system prompt, adapted from a publicly shared jailbreak template, with offensive content layered on top: pre-authorised categories of activity, canned workflows, and instructions that a refusal is a malfunction. Malbear also notes that the prompt was written to hold for the whole session, so the operator never had to re-inject it. Across more than 70 sessions it records no refusal. We are deliberately not reproducing the prompt or its phrase lists. The defensive reading is simple: a model's safety training is a speed bump, not a boundary.

Skills, mapped to the intrusion lifecycle

Malbear lists the harness's skill modules by phase. In its own words (translated) they include passive and active reconnaissance and asset correlation, vulnerability scanning with an emphasis on known (n-day) flaws, a browser-automation skill that can drive authenticated admin panels, lateral movement with the Impacket suite, several tunnelling tools (chisel, frp, suo5), Sliver for command and control, a proxy pool, and credential attack tooling. The useful part for defenders is that each of these is something your telemetry can already see.

A scoring rubric that shows priorities

Malbear recovered a points system the harness used to score its own access, with caps per category and a rule that each system is scored once at its highest privilege. The post's reading: a confirmed pivot into an isolated network segment scored many times more than a server shell, and management access to network devices, security devices and central platforms scored high. At recovery the running total was 3,725 points. If Malbear is right about what the rubric means, the operator was optimising for the control planes, not for individual hosts.

The human in the loop

The operator messages Malbear quotes are strikingly short: a target range, "Go on", a business-style instruction to close the latest high-risk hole, a list of off-limits hosts, and "Stop". The agent answered with long structured reports. Malbear's takeaway is that the person running it does not need to understand the technique, and that the intrusion ran between check-ins.

What security leaders should do this week

• Hunt the behaviour, not the person. Look for fast, parallel, repetitive scanning, authentication and lateral movement, around the clock. Working-hours and dwell-time analysis will under-detect this.
• Watch your segmentation boundaries. If the attacker's rubric rewards boundary breaches most, alert on new flows into isolated segments and on management networks.
• Treat control planes as crown jewels. Network device admin, security tool consoles, backup consoles and virtualisation managers need their own access paths, MFA and logging.
• Check egress for tunnelling. The tools Malbear names (chisel, frp, suo5, Sliver) have well-known behaviours; confirm you can see and block them.
• Close known flaws faster. An agent that prioritises known vulnerabilities shortens the useful life of an unpatched internet-facing service.
• Ask your hosting or cloud provider. Thirteen of the organisations Malbear describes were hosted on the provider's infrastructure. Ask how you would be told if a neighbouring tenant or the provider itself were compromised, and what segmentation protects you.
• Rehearse it. Run a tabletop where the attacker is an agent: what scope can you prove, and how fast can you contain a parallel intrusion?

Frequently asked questions

What is Operation Snowball?

The name Malbear Labs gave to an autonomous AI intrusion campaign found through an exposed open directory, covering more than two weeks of activity against a European telecoms provider and organisations hosted on its infrastructure.

Who found it?

Malbear Labs, in a post published on 8 November 2026. Malbear withheld the directory's IP address to protect the affected organisations.

Which AI model did the attacker use?

Malbear says DeepSeek Flash, with a 1,000,000-token context window, in a harness at version 0.2.0-rc.2. We have not seen DeepSeek comment.

Does this prove the operator was a state actor?

No. Malbear calls the operator Chinese-speaking because the instructions and reports were in Chinese. Language is not attribution.

Can defenders catch an agent by looking for the human behind it?

Malbear's view is that mostly they cannot, because the operator sent only a few short messages. It says the agent's own activity stays visible in endpoint and network telemetry.

What did the harness treat as most valuable?

Per Malbear's reading of a recovered scoring rubric: boundary breaches, then management access to network devices, security devices and central platforms.

Sources

• Malbear Labs: Operation Snowball: Inside an Autonomous AI Intrusion Campaign (8 November 2026), the primary source for everything above.

Independent summary of Malbear Labs' research, written from the portion of the post available to us (through its section on how the harness delegates work). The full post is about 50 minutes long and contains more: read it at the source. Educational guidance for security leaders, not legal advice or a forensic report.