Hunt.io captured the exposed server on June 3, 2026, while the operation was still live.
MeshCentral as a hidden backdoor: how the attacker kept root
Researchers at Hunt.io found an attacker operating inside 3BB — one of Thailand’s largest broadband providers — who maintained remote control of internal machines by abusing MeshCentral, a legitimate remote-management tool. The attacker installed MeshCentral agents on compromised servers and configured them to report to a control server the attacker operated at www.ayuthayatech[.]com under a device group named TH-3BB.
Files recovered from the exposed server show the attacker ran tools from inside 3BB’s network and obtained full administrative control (root) of at least one internal server. A deliberate cleanup script erased logs and other tooling while leaving the MeshCentral agent in place so that the backdoor would persist through any superficial remediation.
Tools, actions, and what the intruder tried to do inside 3BB
The toolkit recovered by Hunt.io shows the intruder actively widened access and hunted for credentials. Scripts sprayed passwords against more than 55 internal computers over SSH, probed an internal sales portal at agent.3bb.co[.]th, and searched compromised machines for stored passwords, database logins, and SSH keys. Other scripts in the collection could plant web shells and add SSH keys as fallback access mechanisms.
Hunt.io concluded the attacker’s primary objective appeared to be subscriber credential data: the server contained scripts built to copy out 3BB’s RADIUS databases, which store the broadband login credentials customers use to get online. The firm emphasized that the evidence shows those databases were targeted, not that any data was confirmed taken.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFortiGate tooling and CVE-2024-21762: capability versus confirmed path
The exposed directory held a sophisticated toolkit aimed at a 3BB FortiGate SSL‑VPN gateway at mail.3bb.co[.]th, including a complete exploit for CVE-2024-21762 — a 2024 Fortinet flaw that can allow remote code execution on affected devices. The targeted gateway was running firmware that the toolkit identified as vulnerable.
Hunt.io cautioned that while the FortiGate tooling was the most developed part of the kit and points to the attacker’s capability and intent, nothing recovered shows the exploit actually worked or that it was the initial route into 3BB.
Indicators, persistence paths, and linked assets
- Attacker server IP: 92.63.180[.]133 (port 8888 hosted the open directory; port 9443 received exploit callbacks)
- MeshCentral control domain: www.ayuthayatech[.]com
- MeshCentral group name: TH-3BB
- Persistence paths observed: /usr/local/bin/.rc (a hidden backdoor) and /usr/local/mesh_services/meshagent/
- Targeted services: mail.3bb.co[.]th (FortiGate SSL‑VPN) and agent.3bb.co[.]th (internal sales portal)
The exposed server also held a valid VPN certificate from 3BB systems and active login sessions for services on the Jasmine network, a company 3BB was once part of and still shares infrastructure with. Hunt.io said that suggests the attacker was working against both 3BB and Jasmine, though it did not confirm a compromise of Jasmine systems.
What this means for 3BB, Jasmine, and security teams
3BB and Jasmine: The presence of a VPN certificate and active Jasmine sessions on the attacker’s server suggests both companies should assume they were in scope and verify whether sessions or credentials were misused. Hunt.io notified the affected companies and the relevant national response team before publishing.
Security and operations teams: Hunt.io’s findings point to immediate, specific actions — check for unexpected MeshCentral agents and unknown management-server connections; rotate SSH keys, database and RADIUS passwords, VPN certificates, and application secrets; and hunt for hidden persistence such as unexpected SUID files, web shells, or newly added remote-management software. Patching edge devices is critical: Fortinet’s advisory for CVE-2024-21762 notes that turning off SSL‑VPN if you cannot patch immediately is required, and disabling web mode alone is not a valid workaround.
End users and customers: Because the intruder focused on RADIUS databases that store customer broadband logins, subscribers and account holders should be alert for account problems and expect their providers to rotate credentials if exposure is confirmed. Hunt.io’s report shows intent and targeting of subscriber data, even where exfiltration is not demonstrated.
The exposed directory the researchers captured has since been closed by the attacker, and Hunt.io says whether the intruder still retains access inside 3BB is unknown — the public record describes the intrusion as it appeared in early June, not today. For organizations running similar edge devices and authentication systems, the technical indicators and the cleanup guidance in Hunt.io’s report are concrete steps to reduce risk and look for backdoors the attacker deliberately tried to conceal.
