3BB Hacker Used MeshCentral Backdoor to Target Subscriber Credentials
Attackers exploited trusted IT tools to maintain root access in Thailand's major broadband network.
1Initial Compromise
Hunt.io discovered an active attacker within 3BB's network using MeshCentral, a legitimate remote management tool, configured as a hidden backdoor. The threat actor maintained root access on internal servers, with agents reporting to a control server under the domain www.ayuthayatech[.]com. Evidence showed the attacker gained full administrative control of systems, though the initial entry vector remains unconfirmed despite finding exploit tools for CVE-2024-21762 targeting 3BB's FortiGate SSL-VPN gateway.
2Lateral Movement Tactics
The attacker employed multiple scripts to expand access, including password spraying against 55+ internal computers via SSH and probing 3BB's internal sales portal. They searched compromised machines for stored credentials, database logins, and SSH keys. Additional scripts could deploy web shells and establish backup access methods. A cleanup script selectively erased logs while preserving the MeshCentral agent to maintain persistence, demonstrating sophisticated operational security.
3Primary Target
Forensic evidence revealed the attacker focused on exfiltrating 3BB's RADIUS databases containing broadband subscriber login credentials. While tools were prepared to copy these databases, Hunt.io couldn't confirm actual data theft. The intrusion also showed signs of targeting Jasmine Network through valid VPN certificates and active sessions, suggesting a broader campaign against interconnected telecom infrastructure in Thailand.
4Operational Timeline
Researchers captured the attacker's exposed server on June 3, 2026, while operations were ongoing. The server contained the attacker's toolkit, machine lists under their control, and evidence of active administrative privileges. By the time of disclosure, the attacker had secured their exposed directory, leaving uncertainty about current network access. The intrusion's full duration remains undetermined as evidence only reflects early June activities.
5Technical Indicators
The compromised MeshCentral instance communicated with TH-3BB device group at ayuthayatech[.]com. Attack tools included FortiGate SSL-VPN exploits for CVE-2024-21762, web shell deployers, and credential harvesting scripts. The toolkit's sophistication suggested capability to exploit multiple vulnerabilities, though researchers couldn't verify which exploits succeeded. The most developed components targeted Fortinet devices, indicating focused research on this attack vector.
6Industry Implications
This attack highlights growing abuse of trusted IT management tools like MeshCentral for persistence. Attackers blend malicious activity with legitimate administrative traffic, making detection challenging. The incident underscores risks in telecom infrastructure where shared systems (like between 3BB and Jasmine) can expand attack surfaces. Such breaches threaten millions of subscribers' data and critical national infrastructure.
7Defensive Recommendations
Organizations using similar edge devices should immediately test for CVE-2024-21762 exploitation and monitor MeshCentral instances for hidden configurations. Hunt.io advises reviewing all remote management tools for unusual device groups or control servers. Network segmentation between parent and subsidiary infrastructures is critical, along with rigorous monitoring of RADIUS database access patterns and VPN certificate usage.
8Response Protocol
Hunt.io followed responsible disclosure by notifying 3BB, Jasmine Network, and Thailand's national response team before publication. The case demonstrates the value of threat intelligence sharing to combat sophisticated intrusions. Companies should establish protocols for rapid CVE testing, prioritize patching critical authentication systems, and implement behavioral detection for credential harvesting activities across internal networks.