Thai Broadband Provider Hacked via Fortinet Vulnerability
Hackers exploited Fortinet CVE-2024-21762 RCE to breach Thai broadband provider 3BB, deploying MeshCentral backdoors and credential-harvesting tools across its network.
Hunt.io uncovered an intrusion staging directory in Thailand containing 298 files of custom tooling built for Triple T Broadband (3BB) and its former owner Jasmine. Initial access came via fingerprinting a FortiGate SSL-VPN appliance and exploiting CVE-2024-21762 for remote code execution, after probing CVE-2018-13379, CVE-2022-42475, and CVE-2023-27997. The actor also probed F5 BIG-IP for CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, escalated privileges with PwnKit and Dirty COW, used MeshCentral as a C2 backdoor, harvested SSH/database/SNMP/Radius credentials, deployed PHP web shells, and ran cleanup scripts to hide the intrusion.
- 298-file staging directory exposed attacker toolkit custom-built for 3BB and Jasmine
- Initial access via FortiGate SSL-VPN fingerprinting and CVE-2024-21762 RCE exploit
- PwnKit and Dirty COW used for Linux privilege escalation with SUID backdoor
- MeshCentral configured as persistent C2; credential harvesting drove lateral movement
- Cleanup script removed artifacts while verifying SUID backdoor and MeshCentral persistence
- CVEs
- CVE-2018-13379CVE-2022-42475CVE-2023-27997CVE-2024-21762CVE-2021-22986CVE-2022-1388CVE-2023-46747
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2021-22986 | Unauthenticated RCE in F5 BIG-IP and BIG-IQ iControl REST | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-1388 | Unauthenticated RCE in F5 BIG-IP via Missing Authentication | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2022-42475 | Unauthenticated Heap Overflow in Fortinet FortiOS/FortiProxy SSL-VPN (Critical RCE) | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2023-27997 | Pre-Auth Heap Buffer Overflow RCE in Fortinet FortiOS/FortiProxy SSL-VPN | 9.8 | 86% | KEVRansomware | KEV |
| CVE-2023-46747 | F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE | 9.8 | 97% | KEVRansomwarePoC ×2 | KEV |
| CVE-2024-21762 | Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy | 9.8 | 85% | KEVRansomware | KEV |
From the original article
2 min read at securityweek.com
The hackers staged numerous scripts for reconnaissance and CVE probing, along with brute-force utilities and privilege escalation tools. The post Thai Broadband Provider Hacked via Fortinet Vulnerability appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.