Trusted Tooling as a Backdoor
An attacker maintained unauthorized access inside 3BB, one of Thailand's largest broadband providers, by installing MeshCentral — a legitimate open-source remote management tool — and quietly configuring it as a hidden backdoor. Threat intelligence firm Hunt.io discovered the intrusion after finding an exposed control server still active as of June 2026.
How the Backdoor Was Configured
The attacker deployed MeshCentral on internal 3BB servers and pointed it at a command-and-control domain, www.ayuthayatech[.]com, under a device group labeled "TH-3BB." As Hunt.io noted, attackers increasingly favor legitimate remote-management software for persistence precisely because its activity blends in with routine IT administration — it doesn't trigger the same alarms as a custom malware implant.
Scope of the Compromise
Recovered device enrollment lists showed multiple machines connected to the backdoor with root-level privileges, indicating active administrative control rather than passive access. The attacker achieved full system access to at least one internal server and expanded to 55+ compromised machines using password-spray attacks against SSH.
The Target: Subscriber Credentials
The attacker's primary objective appears to have been subscriber authentication data. Scripts recovered from the environment were built to extract RADIUS databases — the systems that store broadband customer login credentials. Hunt.io found evidence of targeting these databases, though no confirmation that data was successfully exfiltrated.
A Possible Entry Point
While the attacker possessed a complete exploit toolkit for CVE-2024-21762, a Fortinet FortiGate SSL-VPN vulnerability, Hunt.io found no conclusive proof this was the actual entry vector — only that the targeted VPN gateway was running firmware vulnerable to that flaw.
Discovery and Response
Hunt.io notified 3BB and relevant national incident response teams before publishing its findings. The attacker has since closed the exposed control-panel directory that enabled discovery, and the current state of access to 3BB's network is unknown.
Defender Recommendations
- Patch CVE-2024-21762 on all FortiGate SSL-VPN appliances immediately if not already done
- Hunt for unauthorized MeshCentral agents or other RMM tools not part of your sanctioned toolset
- Rotate all potentially exposed credentials, especially RADIUS and administrative accounts
- Search for additional persistence — web shells, unauthorized SSH keys, SUID binaries
- Preserve forensic logs before any cleanup or remediation activity begins