3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
Hunt.io found an attacker holding root access inside Thai ISP 3BB via a MeshCentral backdoor, targeting subscriber RADIUS credential databases.
Hunt.io discovered an exposed attacker server on June 3, 2026 revealing an ongoing intrusion at 3BB, one of Thailand's largest broadband providers. The attacker maintained hidden MeshCentral agents reporting to www.ayuthayatech[.]com (device group TH-3BB) and held root on internal servers. Recovered scripts sprayed passwords over SSH against more than 55 internal machines, planted web shells, added SSH keys, searched for stored credentials, and targeted RADIUS subscriber credential databases, though exfiltration was not confirmed. The toolkit included a full exploit for FortiGate SSL-VPN flaw CVE-2024-21762 against mail.3bb.co[.]th, but the initial access vector is unestablished, and a cleanup script erased logs while preserving the backdoor.
- MeshCentral remote-management tool configured as hidden backdoor maintained root access on 3BB servers.
- Password spraying hit over 55 internal machines via SSH; web shells and SSH keys added for persistence.
- RADIUS databases holding subscriber credentials were targeted, but exfiltration is unconfirmed.
- FortiGate toolkit included a CVE-2024-21762 exploit, though the entry vector remains unproven.
- Log-wiping cleanup script deliberately preserved the MeshCentral agent to survive remediation.
- CVEs
- CVE-2024-21762
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-21762 | Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy | 9.8 | 85% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | agent.3bb.co | eshagent/ Targets: mail.3bb.co[.]th (FortiGate SSL-VPN) and agent.3bb.co[.]th (internal portal) The full list of indicators, along w |
| domain | ayuthayatech.com | reporting to a control server that the attacker ran at www.ayuthayatech[.]com, under a device group named TH-3BB . Attackers increasing |
| ipv4 | 92.63.180.133 | cators from the report, shown in defanged form: IP address: 92.63.180[.]133, the attacker's server (port 8888 held the open directory |
From the original article
4 min read at thehackernews.com
An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt. io said. The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker's own tools and a list of
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.