Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor
Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.
Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.
- CVE-2024-21762 out-of-bounds write in FortiOS SSL-VPN gave unauthenticated RCE on FortiGate 60F.
- MeshCentral backdoor (group TH-3BB, C2 www.ayuthayatech.com) ran as root on multiple systems.
- Exposed staging directory at 92.63.180[.]133:8888 held 298 files of exploits, credentials, and device inventory.
- Attackers harvested RADIUS database credentials and exploited Ghostcat (CVE-2020-1938) on internal Tomcat.
- Cleanup script cleared logs and web shells but preserved MeshCentral agent and SUID backdoor.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1938 | Ghostcat (CVE-2020-1938): Unauthenticated File Read/JSP RCE via AJP in Apache Tomcat | 9.8 | 99% | KEVPoC | KEV |
| CVE-2024-21762 | Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy | 9.8 | 85% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ayuthayatech.com | fied a device group named TH-3BB and directed agents to www.ayuthayatech[.]com, using the MeshCentral WebSocket endpoint /agent.ashx. A |
| ipv4 | 110.164.129.67 | anagement interface probed for vulnerabilities VPN endpoint 110.164.129[.]67:443 Jasmine OpenVPN endpoint in recovered configuration I |
| ipv4 | 110.164.192.228 | co[.]th Targeted internal 3BB agent portal F5 BIG-IP target 110.164.192[.]228 Management interface probed for vulnerabilities VPN endpo |
| ipv4 | 92.63.180.133 | n first captured on June 3, 2026, the directory, located at 92.63.180[.]133:8888, reportedly held 298 files across 30 subdirectories. |
From the original article
4 min read at gbhackers.com
Threat actors exploited the critical FortiGate SSL-VPN vulnerability CVE-2024-21762 to target the Thai broadband provider Triple T Broadband (3BB). They gained access to its internal environment and deployed MeshCentral remote management agents for persistent control. Hunt.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.