Full Report
An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said. The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker's own tools and a list of
Analysis Summary
# Incident Report: Backdoor Exploitation of 3BB via MeshCentral
## Executive Summary
An unidentified attacker compromised the internal network of 3BB, a major Thai broadband provider, gaining root access to multiple servers. The attacker utilized MeshCentral, a legitimate remote management tool, as a persistent backdoor to maintain control and target subscriber credentials stored in RADIUS databases. The intrusion was discovered by Hunt.io via an exposed attacker-controlled server containing tools and a list of compromised internal machines.
## Incident Details
- **Discovery Date:** June 3, 2026
- **Incident Date:** Active June 2026 (exact start date undetermined)
- **Affected Organization:** 3BB (Triple T Broadband) / Jasmine Network
- **Sector:** Telecommunications / Internet Service Provider
- **Geography:** Thailand
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-June 2026
- **Vector:** Suspected exploitation of Edge Devices (specifically FortiGate SSL-VPN)
- **Details:** Attackers possessed a toolkit targeting a FortiGate SSL-VPN gateway (`mail.3bb.co[.]th`) using an exploit for CVE-2024-21762. While the firmware was vulnerable, initial access via this specific flaw is not confirmed.
### Lateral Movement
- **Details:** The attacker used automated scripts to spray passwords against over 55 internal computers via SSH. They also probed an internal sales portal (`agent.3bb.co[.]th`) and searched for stored database logins and SSH keys on compromised hosts.
### Data Exfiltration/Impact
- **Details:** The primary target was 3BB’s RADIUS databases containing subscriber login credentials. The attacker also obtained a valid VPN certificate and active login sessions for the Jasmine network. While intent to exfiltrate was clear, confirmed volume of data theft was not established at the time of discovery.
### Detection & Response
- **Discovery:** Hunt.io identified an open directory on an attacker-controlled server (`www.ayuthayatech[.]com`) that revealed the scope of the 3BB intrusion.
- **Response Actions:** Hunt.io notified the affected companies and the national incident response team (Thai-CERT) prior to public disclosure.
## Attack Methodology
- **Initial Access:** Likely Vulnerability Exploitation (Suspected CVE-2024-21762).
- **Persistence:** Installation of **MeshCentral** agents configured as hidden backdoors; secondary persistence via web shells and added SSH keys.
- **Privilege Escalation:** Exploitation of internal systems to achieve `root` (administrative) access.
- **Defense Evasion:** Use of a "cleanup script" to erase logs and delete temporary tools while leaving the MeshCentral agent; use of legitimate RMM software to blend with normal traffic.
- **Credential Access:** SSH password spraying; searching file systems for database logins and private keys; targeting RADIUS databases.
- **Discovery:** Probing internal sales portals and scanning the internal network for SSH-enabled devices.
- **Lateral Movement:** SSH and MeshCentral remote control.
- **Collection:** Scripts designed to copy RADIUS database contents.
- **Exfiltration:** Not fully detailed, but setup for database theft was active.
- **Impact:** Potential compromise of thousands of broadband subscriber credentials and lateral access to partner infrastructure (Jasmine).
## Impact Assessment
- **Financial:** Not disclosed; potential for significant remediation costs.
- **Data Breach:** Risk to subscriber credentials (RADIUS) and internal VPN certificates.
- **Operational:** Administrative compromise of critical network infrastructure.
- **Reputational:** High; affects one of the largest ISPs in Thailand.
## Indicators of Compromise
- **Network Indicators:**
- `www.ayuthayatech[.]com` (Attacker C2)
- `mail.3bb.co[.]th` (Targeted Gateway)
- `agent.3bb.co[.]th` (Targeted Internal Portal)
- **Behavioral Indicators:**
- Unauthorized MeshCentral agents reporting to external domains.
- Massive SSH password spraying attempts internally.
- Presence of `TH-3BB` device group in MeshCentral configurations.
## Response Actions
- **Containment:** Notification to 3BB to terminate active sessions and block the attacker C2.
- **Eradication:** Instructions to locate and remove unauthorized MeshCentral agents and web shells.
- **Recovery:** Mandatory rotation of all administrative passwords, SSH keys, and VPN certificates.
## Lessons Learned
- **Living off the Land:** The abuse of legitimate tools like MeshCentral makes detection difficult for traditional antivirus.
- **Edge Risks:** Vulnerable VPN gateways remain the primary entry point for targeting high-value infrastructure.
- **Secondary Persistence:** Attackers often use multiple backdoors (web shells + RMM tools) to ensure access if one is discovered.
## Recommendations
- **Patch Management:** Immediately patch FortiGate devices against CVE-2024-21762 or disable SSL-VPN if patching is not possible.
- **RMM Monitoring:** Implement strict application control to whitelist only approved remote management tools and monitor for unauthorized C2 connections.
- **Credential Hygiene:** Use Multi-Factor Authentication (MFA) for all internal SSH and administrative access to prevent lateral movement via password spraying.