The threat analysis company Hunt.io identified an active intrusion into the network of 3BB, one of Thailand’s largest broadband providers. According to the researchers, the attacker gained full administrative control (root) over the company’s internal servers and used the legitimate remote administration tool MeshCentral as a stealth backdoor. The primary target of the attack, reportedly, was RADIUS databases — systems that store subscriber credentials used to connect to the internet. At the same time, there is no confirmation that subscriber data was successfully stolen.
How the intrusion was discovered
According to Hunt.io, on June 3, 2026, the researchers observed an open server controlled by the attacker containing 298 files in 30 directories: exploitation scripts, privilege escalation tools, MeshCentral configuration, and an inventory list of compromised machines. The tools were being run from a computer inside the 3BB network, and the operation was still active at the time of discovery.
Attacker tactics
Persistence via MeshCentral
MeshCentral is a free tool typically used by IT teams for remote administration. The attacker configured it as a hidden backdoor: agents were reporting to a management server on the domain www.ayuthayatech[.]com in the device group TH-3BB. Based on the reconstructed device list, several machines were connected and running with root privileges, which indicates active administrative control at the time the inventory was exported.
A dedicated cleanup script was written to delete logs and other attacker tools while deliberately preserving the MeshCentral agent — ensuring access survived even after traces were wiped.
Lateral movement and data collection
According to Hunt.io, the recovered scripts performed SSH password brute forcing against more than 55 internal hosts, probed the internal 3BB sales portal (agent.3bb.co[.]th), and searched compromised machines for stored passwords, database credentials, and SSH keys. Other scripts could deploy web shells and add SSH keys as backup access channels.
Targeting RADIUS databases
The scripts on the server were designed to copy RADIUS databases — authentication systems that store logins and passwords for broadband subscribers. It is important to stress that the available evidence confirms a focus on these databases but does not confirm that data exfiltration was successful.
Possible link to Jasmine
The server contained a valid VPN certificate from 3BB systems and active sessions for Jasmine network services — a company that 3BB previously belonged to and with which it still shares infrastructure. Hunt.io notes that this suggests the attacker may have been operating against both organizations; however, there is no confirmation that Jasmine itself was compromised.
Initial access and CVE-2024-21762
The method of initial penetration into the 3BB network has not been established. The server held a full set of tools for attacking the FortiGate SSL-VPN gateway (mail.3bb.co[.]th), including an exploit for CVE-2024-21762 — a critical out-of-bounds write vulnerability in FortiOS with a CVSS score of 9.8 that allows unauthenticated remote code execution. The targeted gateway was running a vulnerable firmware version.
There is a discrepancy in assessments here: in its report, Hunt.io states that code execution via the exploit was successful, with a reverse connection to the attacker’s server, whereas news coverage indicates that the recovered evidence does not confirm that the exploit worked or that it was the vector of compromise. No independent confirmation of either position has been found. The most balanced assessment is that the FortiGate toolkit was the most developed part of the package and demonstrates the attacker’s capabilities and intentions, but the question of initial access remains open.
The CVE-2024-21762 vulnerability itself affects a wide range of FortiOS versions (from 6.0.x to 7.4.2) and FortiProxy (from 1.0.x to 7.4.2). CISA added it to the Known Exploited Vulnerabilities catalog back in February 2024 on the basis of confirmed exploitation in the wild. We have previously covered vulnerabilities in Fortinet products, and this incident confirms that devices from this vendor remain a priority target for attackers.
Impact assessment
3BB serves a significant share of the broadband market in Thailand. Compromise of the RADIUS infrastructure of a provider of this size could potentially put the credentials of millions of subscribers at risk. Even in the absence of confirmed data leakage, the mere fact of root access to internal servers and focus on authentication databases creates serious risks — from mass traffic interception to using compromised accounts for further attacks.
The presence of anti-forensic scripts that intentionally destroy traces while preserving access points to a prepared attacker interested in long-term presence. The attack has not been attributed — neither the actor nor the group has been identified.
Recommendations for defenders
- Patching FortiGate SSL-VPN: make sure devices are updated and not vulnerable to CVE-2024-21762. According to the Fortinet advisory, if immediate patching is not possible, disable SSL-VPN completely; disabling only web mode is not sufficient.
- Search for unauthorized MeshCentral agents: check for MeshCentral processes and files that were not deployed by your IT team, as well as connections to unknown management servers.
- Credential rotation: replace SSH keys, database passwords, RADIUS passwords, VPN certificates, and application secrets. Applying a patch does not remove an already installed agent or reset a password that has already been copied.
- Hunt for hidden access channels: look for unexpected SUID files, web shells, modified SSH keys, and newly installed remote administration software.
- Log preservation: ensure logs and artifacts are preserved before starting cleanup — the attacker’s script was explicitly designed to destroy them.
Indicators of compromise
- IP address: 92.63.180[.]133 (port 8888 — open directory, port 9443 — exploit reverse connection)
- C2 domain: www.ayuthayatech[.]com (MeshCentral management server)
- MeshCentral group: TH-3BB
- Persistence paths:
/usr/local/bin/.rc,/usr/local/mesh_services/meshagent/ - Web shells:
/var/www/html/info.php,/var/www/dashboard/.r.php - Targeted hosts: mail.3bb.co[.]th (FortiGate SSL-VPN), agent.3bb.co[.]th (internal portal)
This incident clearly demonstrates why patching perimeter devices alone is not enough: when an attacker has root access, installed persistence agents, and anti-forensic scripts, recovery requires a full infrastructure audit, rotation of all potentially compromised credentials, and focused hunting for hidden return channels. Organizations using FortiGate SSL-VPN should immediately verify their CVE-2024-21762 patch status and search for unauthorized remote administration agents in their networks.
