---
title: Hunt: Operation Snowball, a Sliver domain, PowerShell watchdog files in C:\Windows\Temp, Unicode-escaped JSP web shells and BladeLogic RSCD pivots | ctxsec
url: https://ctxsec.com/items/hunt-operation-snowball-sliver-tablacysexplorer-temp-ps1-watchdog-unicode-escaped-jsp-rscd
description: "Indicators and behaviors Malbear recovered from the autonomous agent's workspace. Network indicators are few; the behaviors are the durable part."
status: "vendor research (Malbear Labs IOCs and behaviors, Nov 8, 2026)"
published: 2026-11-12
---

> Indicators and behaviors Malbear recovered from the autonomous agent's workspace. Network indicators are few; the behaviors are the durable part.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-operation-snowball-sliver-tablacysexplorer-temp-ps1-watchdog-unicode-escaped-jsp-rscd.md)

vendor research (Malbear Labs IOCs and behaviors, Nov 8, 2026)

2026-11-12 11:37 AM ET

### Hunt: Operation Snowball, a Sliver domain, PowerShell watchdog files in C:\Windows\Temp, Unicode-escaped JSP web shells and BladeLogic RSCD pivots

- **Network:** Sliver C2 `api.tablacysexplorer[.]com` (Cloudflare-fronted, 443); `146.70.53[.]182:2299` (SSH to Sliver server); `113.23.212[.]15:8000` (tool staging); `212.46.38[.]73:56777` (operator machine); egress via VPNGate relays.
- **Windows:** several .ps1 files in `C:\Windows\Temp` where a watchdog re-hashes a command script every 5 seconds and updates a lock file, plus results/done-flag files; two hidden PowerShell processes created via WMI `Win32_Process.Create` with `-enc` payloads connecting out on TCP 21; IFM/shadow-copy NTDS dumps followed by quick deletion.
- **Web tier:** JSP files whose scriptlets are written as `\uXXXX` escapes (normalize before signature matching); Behinder JSP, WAR deployments via JBoss manager; ASPX shells next to services named like Update Orchestrator components; PHP shells taking `?c=` with encoded PowerShell.
- **Lateral:** connections to BladeLogic RSCD 4750 from application servers; Zabbix native-protocol (ZBXD header) queries from non-Zabbix hosts; SAP DIAG probes on 3220; Liferay `portal_ext.log` reads.
- **AD recon for AI assets:** LDAP searches for hostnames containing OLLAMA, LLM, JUPYTER or GPU.

Sources: [Malbear Labs: Operation Snowball: Inside an Autonomous AI Intrusion Campaign (Nov 8, 2026)](https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign)