Malbear Labs says an AI agent attacked a European telecom provider for two weeks

Security company Malbear Labs says an artificial intelligence agent attacked a European telecommunications provider and 13 organizations hosted in its data centres and cloud for more than two weeks, as reported by Infosecurity Magazine. Malbear, which calls the campaign Operation Snowball, published its research on November 8 and does not identify the affected company.

According to Malbear, which bases this on an unprotected attacker directory with more than 70 session transcripts and the agent's own reports, the system ran on the DeepSeek Flash model with instructions of about 78,000 characters so that it would not refuse any order. The operator, again according to Malbear, gave brief instructions and checked progress from time to time, while the agent exploited known flaws, including one in Cisco BroadWorks fixed in August, and changed technique on its own when security blocked it.

The transcripts show, according to Malbear, that the agent obtained dozens of credentials and private keys, and that in its reports it claimed to have reached subscriber billing data, millions of patient records in a database with default passwords and about 80 backups of monitoring systems.

Malbear considers the activity consistent with a Chinese-origin operator and does not link it to any state. Infosecurity Magazine notes that the publication does not say whether Malbear checked those claims with any victim, what was actually stolen or whether all 13 organizations were breached.

Developing story: everything comes from the research of a private company, known through a single specialist outlet; there is no confirmation from the victims, from DeepSeek or from any public body, and Malbear's original report could not be opened.