3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials

A Thai broadband provider, 3BB, has been targeted by an attacker who exploited a remote management tool, MeshCentral, to gain unauthorized access to its internal network and steal subscriber data. Threat intelligence firm Hunt.io uncovered the intrusion by examining a server the attacker had left open on the internet, which contained the attacker’s tools and a list of machines already under their control. The server, accessible at 92.63.180[.]133, held a MeshCentral backdoor, allowing the attacker to maintain remote control of internal machines.

To maintain this access, the attacker installed MeshCentral, a free tool commonly used by IT teams to manage computers remotely. The recovered settings showed it was configured as a hidden backdoor, with agents reporting to a control server at www.ayuthayatech[.]com, under a device group named TH-3BB. The attacker’s primary goal was 3BB’s subscriber data, and they deployed scripts to copy out the company’s RADIUS databases, which store login credentials for broadband customers.

The attacker also targeted other systems, including mail.3bb.co[.]th (FortiGate SSL-VPN) and agent.3bb.co[.]th (internal sales portal). The server held a valid VPN certificate from 3BB’s own systems and active login sessions for services on the Jasmine network, a company 3BB was once part of and still shares infrastructure with. The researchers believe this indicates the attacker was attempting to compromise Jasmine as well, though it is not confirmed.

Crucially, the attacker gained initial access through a vulnerable FortiGate SSL-VPN gateway, utilizing CVE-2024-21762, a critical 2024 Fortinet flaw. The gateway was running a firmware version affected by the vulnerability, but Hunt.io’s analysis indicates that the exploit itself did not work, suggesting the attacker’s intent was to establish a foothold, not necessarily to break in through that specific device.

The attacker has since closed the exposed directory. Whether they still have access inside 3BB remains unknown, as the evidence describes the intrusion as it stood in early June. Hunt.io notified the affected companies and the relevant national response team about their findings before publishing.

**What Defenders Should Do:**

• Patch or confirm that FortiGate SSL-VPN appliances are fixed against CVE-2024-21762. Fortinet’s advisory states that if you cannot patch at once, you should turn off SSL-VPN, and that turning off web mode alone is not a valid workaround.
• Check for MeshCentral agents you did not install, and for connections to management servers you do not recognize.
• Rotate credentials that may have been exposed, including SSH keys, database and RADIUS passwords, VPN certificates, and application secrets.
• Hunt for hidden ways back in, such as unexpected SUID files, web shells, changed SSH keys, and newly added remote-management software.
• Preserve logs and evidence before cleaning up, because the attacker’s own script was built to erase them.

**Key Indicators:**

• IP address: 92.63.180[.]133
• Domain: www.ayuthayatech[.]com
• MeshCentral group: TH-3BB
• Persistence paths: /usr/local/bin/.rc, /usr/local/mesh_services/meshagent/
• Targets: mail.3bb.co[.]th, agent.3bb.co[.]th