Introduction
A compromised European telecom operator. Thirteen organizations hosted in its datacenters exposed in a chain reaction. Millions of patient records exfiltrated, all over more than two weeks, without triggering a single major alert. That is the scenario documented by security researchers in the Operation Snowball report, published in early November 2026. The campaign offers an unsettlingly clear illustration of a risk that IT teams still struggle to quantify: the hosting provider as a cross-cutting intrusion vector.
The Network Core as the Entry Point
The attack exploited an unauthenticated XXE (XML External Entity) vulnerability in Cisco BroadWorks XSP, a central component of enterprise telephony platforms. This type of flaw on telecom infrastructure is far from trivial: BroadWorks is deployed by dozens of operators worldwide to manage call signaling and subscriber identities. A successful exploit allows attackers to extract credential sets, SSL keys, and configuration files, all of which then unlock access to adjacent systems.
Researchers were able to reconstruct the full intrusion timeline from approximately sixty session transcripts recovered on a staging server the attacker had left exposed. The toolkit deployed was extensive: a C2 framework tunneled behind Cloudflare, Java webshells, lateral movement tools, high-performance intranet network scanners, and brute-force attacks against authentication services. A professional offensive contractor's toolkit, operated largely without human intervention.
The Cascade: From Operator to Hosted Clients
This is where the campaign's true scale becomes apparent. Once the operator's infrastructure was compromised, the attackers pivoted to the thirteen organizations hosted in its datacenters. Liferay portals, JBoss servers, Citrix NetScaler instances, PAN-OS appliances, Oracle and SAP HANA databases, the breadth of systems affected mirrors the diversity of tenants typical of a mid-sized shared hosting provider.
Among the exfiltrated data: millions of patient records from a hospital management software platform, RSA private keys, network monitoring configurations, and Active Directory credentials belonging to medical organizations. Assets that did not belong to the telecom operator itself, but that transited through its infrastructure.
This pattern, infrastructure provider compromised, customers automatically exposed, is structurally different from a direct attack on a target organization. The hosted client's firewall was bypassed not through a flaw in its own perimeter, but via an entry point on the host's network side.
What the Campaign's Duration Reveals
More than two weeks of undetected activity: that window deserves scrutiny. Recovered logs show that certain endpoint solutions did block isolated exploitation attempts, forcing the attackers to adapt their vectors. But those alerts never triggered a coordinated response. The ability to bypass defensive measures in real time, switching tools or techniques without interruption, raises a fundamental question about whether detection architectures are fit for purpose against campaigns that adapt continuously.
Questions Every CIO Should Be Asking Their Hosting Provider
For CIOs and CISOs whose systems are hosted with a telecom operator or third-party infrastructure provider, this case raises several concrete questions:
- What network isolation exists between the provider's infrastructure and tenant environments?
- If the host's network is compromised, what detection mechanisms apply on the tenant side?
- Do security SLAs include a commitment on notification timeframes in the event of an incident on shared infrastructure?
- Are the administrative traffic flows between host and hosted systems audited and segmented?
Hosting with a telecom operator delivers guarantees around connectivity and uptime. It does not exempt organizations from building a defense-in-depth posture that does not assume the integrity of the underlying infrastructure.