Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider

Researchers have uncovered an exposed attacker-controlled staging server containing evidence of a wide-ranging intrusion targeting 3BB, the consumer brand operated by Thailand’s Triple T Broadband.

The investigation links the operation to the exploitation of a critical SSL-VPN vulnerability, followed by privilege escalation, credential theft, internal reconnaissance, lateral movement, and persistent remote access.

FortiGate SSL-VPN Vulnerability

Hunt.io first recorded the open directory at 92.63.180[.]133:8888 on June 3, 2026. Hosted on Bangmod Enterprise infrastructure, the server held 298 files in 30 subdirectories, totaling 19 MB.

The collection provided an unusually detailed view of the attacker’s operation. It included FortiGate exploitation scripts, Linux privilege-escalation tools, SSH brute-force utilities, database credential harvesters, VPN configuration files, captured session cookies, cleanup scripts, and a live MeshCentral agent configuration.

Multiple artifacts referenced 3BB infrastructure directly, including internal 10.11.x.x addresses, systems under the triplet.co.th domain, and organization-specific credentials.

A captured network configuration placed one compromised machine at 10.11.152[.]63, indicating that at least some tools were executed from inside the broadband provider’s network rather than solely from the external staging server.

The apparent initial target was a FortiGate 60F SSL-VPN appliance exposed through mail.3bb.co[.]th:10443. Eight reconnaissance scripts fingerprinted the VPN service, examined HTTP headers and FortiGate resources, and tested several historical vulnerabilities before the actor focused on CVE-2024-21762.

CVE-2024-21762 is a critical out-of-bounds write vulnerability in the FortiOS and FortiProxy SSL-VPN component. It can allow an unauthenticated remote attacker to execute arbitrary code or commands by sending specially crafted HTTP requests and carries a CVSS score of 9.8 in the NVD.

CISA added the flaw to its Known Exploited Vulnerabilities catalog in February 2024 after confirming active exploitation.

According to the recovered scripts, the attacker first used controlled crashes and malformed chunked HTTP requests to determine whether the appliance was vulnerable.

The final exploit reportedly combined heap spraying with a return-oriented programming chain to launch a reverse shell connecting to 92.63.180[.]133:9443, the same server hosting the exposed toolkit.

The actor also attempted to obtain FortiOS 7.2.5 firmware for the FortiGate 60F, apparently to identify model- and version-specific ROP gadgets. One script embedded the appliance’s serial number in a request intended to impersonate the device when contacting Fortinet’s distribution infrastructure.

After establishing access, the attacker deployed MeshCentral as a persistent remote-management backdoor. MeshCentral is a legitimate open-source platform providing remote desktop, terminal, and file-management capabilities through installed endpoint agents.

The recovered meshagent.msh configuration assigned infected machines to a device group named TH-3BB and directed agents to www.ayuthayatech[.]com over port 443.

A devices.json export listed multiple enrolled systems as connected, with several agents running as root, indicating active administrative control at the time of export.

Persistence scripts automated MeshCentral installation, checked outbound connectivity, and looked for endpoint security products before deployment.

Significantly, the attacker’s cleanup_target.sh script deleted exploitation files, web shells, authentication logs, system logs, and shell histories while intentionally preserving the MeshCentral service.

The operation extended beyond the FortiGate appliance. Eleven reconnaissance scripts targeted agent.3bb.co[.]th, a CodeIgniter-based sales portal located behind an F5 BIG-IP appliance, testing authentication, session forgery, file uploads, SQL injection, path traversal, server-side request forgery, and HTTP request smuggling.

The attacker prepared several privilege-escalation options for compromised Linux servers, including Dirty COW and PwnKit exploits, together with code for installing a concealed SUID backdoor.

Another tool targeted an internal Pentaho server using the Ghostcat vulnerability, while a captured output file reportedly documented root-level command execution on a Linux application server.

Credential-harvesting scripts searched systems for SSH private keys, PHP configuration files, database passwords, SNMP community strings, and command histories.

Other scripts targeted the radius_corp, radiusinfo, and job_radius databases, potentially exposing subscriber authentication records and network access server information.

More than 55 internal addresses were included in SSH password-spraying scripts containing both common passwords and organization-specific combinations.

The presence of 3BB-related credentials suggests prior knowledge of the environment, although the available evidence does not establish how the attacker obtained that information.

Researchers also found jasmine.ovpn, an OpenVPN profile containing a certificate and private key issued under Triple T Broadband’s public key infrastructure.

If the credential remained valid, it could potentially provide access to infrastructure associated with the Jasmine network, highlighting the importance of revoking exposed certificates rather than relying only on password resets.

Fortinet identifies FortiOS 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, and several other releases as vulnerable. Administrators should upgrade to a supported fixed release; where immediate patching is impossible, Fortinet recommends disabling SSL-VPN entirely because disabling web mode alone is not a valid workaround.

Potentially affected organizations should investigate unexpected MeshCentral agents, connections to www.ayuthayatech[.]com, reverse-shell traffic involving 92.63.180[.]133, hidden SUID files, web shells, modified SSH authorization files, and unexplained gaps in security logs.

VPN certificates, RADIUS secrets, database credentials, SSH keys, application secrets, and privileged passwords should be rotated, while forensic evidence should be preserved before remediation because the recovered toolkit shows deliberate anti-forensic activity.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.