Hunt.io Details Fortinet and F5 Exploitation in Attack on Thai Broadband Provider 3BB
Summary
Hunt.io reports that attackers exploited a FortiGate vulnerability to access 3BB systems, then attempted privilege escalation, lateral movement, credential theft and persistent access using MeshCentral and other tools.
Key points
- Hunt.io says attackers fingerprinted 3BB’s FortiGate SSL-VPN endpoint and exploited CVE-2024-21762 for remote code execution.
- The actor also probed 3BB’s F5 BIG-IP system and internal sales portal for vulnerabilities.
- An exposed directory reportedly held 298 files, including exploit scripts, credential-harvesting tools, a compromised-machine inventory and a MeshCentral agent configured for persistence.
- Attackers attempted to gain root privileges on Linux systems using PwnKit, Dirty COW and a SUID backdoor installer.
- Hunt.io reports attempts to move laterally and collect SSH keys, database credentials, SNMP community strings and Radius authentication data.
- Scripts reportedly deployed PHP web shells, injected SSH keys and modified database privileges; a cleanup script removed artifacts while checking that persistence remained operational.
Article Details
- Attack Vectors
- The attackers fingerprinted a FortiGate SSL-VPN endpoint, identified its firmware version, and exploited CVE-2024-21762 to gain remote code execution.
- They probed an F5 BIG-IP instance and 3BB’s internal sales agent portal for vulnerabilities.
- They attempted privilege escalation on Linux systems using PwnKit and Dirty COW exploits and a SUID backdoor installer.
- They used scripts for host discovery, credential harvesting, and lateral movement, and attempted to extract SSH keys, configuration data, database credentials, SNMP community strings, and Radius authentication data.
- They deployed PHP web shells, injected SSH keys, modified database privileges, and used MeshCentral for persistent remote access.
- A cleanup script removed exploitation and backdoor artifacts and system logs while checking that persistence remained operational.
- Defensive Notes
- Review FortiGate SSL-VPN exposure and firmware, and address CVE-2024-21762.
- Investigate suspicious MeshCentral deployments, hidden SUID binaries, PHP web shells, injected SSH keys, and unexpected database privilege changes.
- Review Linux hosts for exploitation artifacts, credential harvesting, unauthorized remote access, and deleted logs.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThey attempted Linux privilege escalation using PwnKit and Dirty COW exploits.T1070.001 · Clear Windows Event LogsThe cleanup script removed system logs.T1070.004 · File DeletionA cleanup script removed exploitation artifacts, backdoor deployment files, and PHP web shells.T1098.004 · SSH Authorized KeysThey injected SSH keys to support persistence and lateral movement.T1190 · Exploit Public-Facing ApplicationThey exploited CVE-2024-21762 on a FortiGate SSL-VPN endpoint to gain remote code execution.T1219 · Remote Access ToolsThey used a MeshCentral agent for persistent remote administration.T1505.003 · Web ShellThey deployed PHP web shells for persistence and lateral movement.T1552.001 · Credentials In FilesThey attempted to obtain credentials from PHP configurations and other files.T1552.004 · Private KeysThey attempted to extract SSH keys from compromised systems.T1595.002 · Vulnerability ScanningThe attackers probed FortiGate and F5 BIG-IP instances for vulnerabilities.
CVE
CVE-2018-13379The attackers scanned for bugs such as CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762, confirmed the instance’s firmware version, and deployed an exploit targeting CVE-2024-21762 to achieve remoteCVE-2021-22986operation against the victim’s F5 BIG-IP instance, probing for multiple vulnerabilities, including CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, and against 3BB’s internal sales agent portal, running behind theCVE-2022-1388the victim’s F5 BIG-IP instance, probing for multiple vulnerabilities, including CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, and against 3BB’s internal sales agent portal, running behind the load balancer.CVE-2022-42475The attackers scanned for bugs such as CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762, confirmed the instance’s firmware version, and deployed an exploit targeting CVE-2024-21762 to achieve remoteCVE-2023-27997The attackers scanned for bugs such as CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762, confirmed the instance’s firmware version, and deployed an exploit targeting CVE-2024-21762 to achieve remoteCVE-2023-46747BIG-IP instance, probing for multiple vulnerabilities, including CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, and against 3BB’s internal sales agent portal, running behind the load balancer.CVE-2024-21762The attackers scanned for bugs such as CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762, confirmed the instance’s firmware version, and deployed an exploit targeting CVE-2024-21762 to achieve remote
Vendors
F5A threat actor targeted multiple vulnerabilities in Fortinet and F5 products to gain access to Thai broadband provider 3BB’s systems, Hunt.io reports.FortinetA threat actor targeted multiple vulnerabilities in Fortinet and F5 products to gain access to Thai broadband provider 3BB’s systems, Hunt.io reports.
Products
F5 BIG-IPSimultaneously, the threat actor executed a reconnaissance operation against the victim’s F5 BIG-IP instance, probing for multiple vulnerabilities, including CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, andFortinet FortiGateInitial access was obtained through careful fingerprinting of a FortiGate SSL-VPN endpoint using eight shell scripts designed to determine the appliance’s firmware version, probe for vulnerabilities, and deploy exploits.