An attacker operated covertly within the network of **3BB**, a major Thai broadband provider, leveraging a legitimate management tool called **MeshCentral** to maintain remote control over internal machines, according to a report by threat intelligence firm **Hunt.io**. **Hunt.io** uncovered the intrusion by examining an attacker-controlled server inadvertently left exposed on the internet. This server contained the attacker's tools and a comprehensive list of compromised machines. Researchers captured the exposed server on June 3, 2026, while the operation was still active. Analysis revealed that the tools had been executed from within **3BB**'s network, with one recovered file indicating the attacker had achieved full administrative (root) control of an internal server. To ensure persistent access, the attacker installed **MeshCentral**, a free remote management tool typically used by IT teams. The recovered configuration showed it was set up as a hidden backdoor, with agents reporting to a control server at `www.ayuthayatech[.]com` under a device group named **TH-3BB**. Attackers are increasingly abusing such remote-management software because its trusted nature allows malicious activity to blend seamlessly with legitimate administration, making detection challenging. A device list retrieved from the server detailed the machines enrolled in the attacker's **MeshCentral** setup. Several were actively connected and operating with root privileges when the list was compiled, confirming the attacker's active administrative control at that time. A separate cleanup script was designed to erase logs and delete other attacker tools, crucially leaving the **MeshCentral** agent intact to preserve access. Inside the network, the attacker actively worked to expand their foothold. Recovered scripts included password spraying against over 55 internal computers via SSH, probing **3BB**'s internal sales portal at `agent.3bb.co[.]th`, and searching compromised machines for stored passwords, database logins, and SSH keys. Other scripts were capable of deploying web shells—hidden pages for executing commands—and adding SSH keys for backup access. **Hunt.io** believes the attacker's primary objective was **3BB**'s subscriber data. Scripts on the server were designed to exfiltrate the company's RADIUS databases, which store customer login credentials for broadband access. While these databases were targeted, there is no confirmed evidence that data was successfully exfiltrated. The same exposed server also suggested a secondary target. It contained a valid VPN certificate from **3BB**'s systems and active login sessions for services on the **Jasmine** network, a company with which **3BB** shares historical ties and infrastructure. **Hunt.io** indicated this suggested an attack against both entities, though a breach of **Jasmine** itself was not confirmed.  The initial access vector into **3BB** remains unconfirmed. The attacker's server held a complete toolkit targeting a **3BB FortiGate SSL-VPN** gateway, specifically the remote-access box at `mail.3bb.co[.]th`. This toolkit included a full exploit for **CVE-2024-21762**, a critical **Fortinet** flaw from 2024 that allows unauthenticated code execution. The targeted gateway was running a vulnerable firmware version. However, **Hunt.io** found no evidence that this exploit was successfully used or that it was the method of initial intrusion. While the **FortiGate** tooling demonstrates the attacker's capabilities and intent, it does not confirm a breach through this specific device. The attacker has since secured the exposed directory. Whether they retain access within **3BB** is currently unknown, as the evidence reflects the state of the intrusion in early June. **Hunt.io** confirmed that they notified the affected companies and the relevant national incident response team prior to publishing their findings. ### What Defenders Should Do The recovered toolkit provides a clear set of recommendations for organizations operating similar edge devices and authentication systems: * **Patch FortiGate SSL-VPN Appliances**: Immediately patch or confirm that **FortiGate SSL-VPN** appliances are secured against **CVE-2024-21762**. **Fortinet's** advisory states that if immediate patching is not possible, SSL-VPN functionality should be disabled entirely, as disabling web mode alone is insufficient. * **Inspect for Unauthorized MeshCentral Agents**: Actively check for any **MeshCentral** agents that were not legitimately installed and for connections to unrecognized management servers. * **Rotate Exposed Credentials**: Promptly rotate any potentially compromised credentials, including SSH keys, database and RADIUS passwords, VPN certificates, and application secrets. Patching vulnerabilities does not remove an already installed agent or reset a copied password. * **Hunt for Persistence Mechanisms**: Search for hidden persistence methods, such as unexpected SUID files, web shells, modified SSH keys, and newly added remote-management software. * **Preserve Logs**: Before initiating cleanup, preserve all logs and forensic evidence, as the attacker's scripts were designed to erase them. Key indicators from the report, presented in defanged form: * **IP Address**: `92.63.180[.]133` (attacker's server, port 8888 for open directory, port 9443 for exploit callback) * **Domain**: `www.ayuthayatech[.]com` (MeshCentral control server) * **MeshCentral Group**: `TH-3BB` * **Persistence Paths**: `/usr/local/bin/.rc` (hidden backdoor), `/usr/local/mesh_services/meshagent/` * **Targets**: `mail.3bb.co[.]th` (FortiGate SSL-VPN), `agent.3bb.co[.]th` (internal portal) The complete list of indicators and technical details can be found in **Hunt.io's** full report.