Attacker Used MeshCentral to Maintain Root Access Inside Thailand’s 3BB Network
Summary
Hunt.io found an attacker using MeshCentral to maintain access inside 3BB, targeting subscriber credentials and internal systems. RADIUS data theft and a FortiGate exploit remain unconfirmed; current access is unknown.
Key points
- Hunt.io found an exposed server containing the attacker’s tools and a list of controlled machines; researchers captured it on June 3, 2026, while the operation was live.
- MeshCentral was configured as a hidden backdoor, with agents reporting to www[.]ayuthayatech[.]com under the group name TH-3BB; evidence showed active administrative control of internal machines.
- Scripts attempted password spraying over SSH against more than 55 internal computers, probed agent[.]3bb[.]co[.]th, and searched compromised systems for credentials and SSH keys.
- Scripts targeted 3BB’s RADIUS databases, but the investigation found no evidence that subscriber data was actually taken.
- The toolkit included exploit code for CVE-2024-21762 targeting mail[.]3bb[.]co[.]th, a FortiGate SSL-VPN gateway. Researchers did not establish that the exploit worked or enabled the intrusion.
- A VPN certificate and active sessions suggested possible activity involving the Jasmine network, but Hunt.io did not confirm a Jasmine breach. Whether the attacker still has access to 3BB is unknown.
- Recommended defenses include patching affected FortiGate appliances, checking for unauthorized MeshCentral agents, rotating potentially exposed credentials, hunting for persistence, and preserving logs.
Article Details
- Attack Vectors
- The attacker maintained remote access using MeshCentral configured as a hidden backdoor, with agents reporting to an attacker-operated control server.
- Recovered scripts sprayed passwords against more than 55 internal computers over SSH and searched compromised machines for stored passwords, database logins, and SSH keys.
- Scripts could plant web shells and add SSH keys as backup access methods.
- Scripts targeted 3BB RADIUS databases for copying, although the article says there is no evidence that data was taken.
- The toolkit included exploit code for CVE-2024-21762 targeting 3BB’s FortiGate SSL-VPN gateway; the article does not establish that the exploit worked or was used to gain access.
- Defensive Notes
- Patch FortiGate SSL-VPN appliances against CVE-2024-21762; if immediate patching is not possible, disable SSL-VPN. Disabling web mode alone is not a valid workaround, according to the cited Fortinet advisory.
- Check for unrecognized MeshCentral agents and connections to unknown management servers.
- Rotate potentially exposed SSH keys, database and RADIUS passwords, VPN certificates, and application secrets.
- Hunt for unexpected SUID files, web shells, changed SSH keys, and newly installed remote-management software.
- Preserve logs and evidence before cleanup because the attacker’s script was designed to erase logs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | www[.]ayuthayatech[.]com | Attacker-operated MeshCentral control server used by the backdoor agents. |
| IPV4 | 92[.]63[.]180[.]133 | Attacker server hosting the exposed directory; port 9443 received the exploit callback. |
MITRE ATT&CK
T1005 · Data from Local SystemScripts targeted 3BB’s RADIUS databases for copying; the article does not confirm that data was taken.T1070.002 · Clear Linux or Mac System LogsA cleanup script was written to erase logs while leaving the MeshCentral agent in place.T1078 · Valid AccountsRecovered scripts sprayed passwords against more than 55 internal computers over SSH; the article does not say whether the attempts succeeded.T1098.004 · SSH Authorized KeysScripts could add SSH keys as backup ways to regain access.T1190 · Exploit Public-Facing ApplicationThe toolkit included exploit code targeting the internet-facing FortiGate SSL-VPN gateway via CVE-2024-21762, but successful exploitation or initial access through it was not established.T1219 · Remote Access ToolsMeshCentral, a legitimate remote-management tool, was configured as a hidden backdoor for remote control of internal machines.T1505.003 · Web ShellRecovered scripts could plant web shells as a means of executing attacker commands.T1552 · Unsecured CredentialsScripts searched compromised machines for stored passwords, database logins, and SSH keys.
CVE
Vendors
Products
FortiGate SSL-VPNThe intrusion targeted subscriber data, internal portals, and a FortiGate SSL-VPN gateway, with evidence also pointing to possible overlap with the Jasmine network.Fortinet FortiGateThe intrusion targeted subscriber data, internal portals, and a FortiGate SSL-VPN gateway, with evidence also pointing to possible overlap with the Jasmine network.MeshCentralHunt.io found an attacker inside 3BB’s network in Thailand using MeshCentral as a hidden backdoor to keep remote control of internal systems.