Thai Broadband Provider Hacked via Fortinet Vulnerability

An Attacker's Entire Toolkit, Left in the Open

Researchers at Hunt.io have uncovered the full extent of an intrusion into 3BB (Triple T Broadband), one of Thailand's largest fixed-line broadband providers with millions of subscribers, after the attacker left a staging server exposed on the open internet. The directory — first observed live on June 3, 2026 at 92.63.180[.]133:8888 — contained 298 files across 30 subdirectories: exploitation scripts, brute-force utilities, privilege-escalation tools, credential harvesters, an inventory of already-compromised machines, and a live MeshCentral backdoor configuration.

Unlike most breach disclosures, which rely on after-the-fact forensics, this cache gave researchers a near real-time view of an active intrusion, including the attacker's own notes and target lists.

The Fortinet Vulnerability at the Root of the Attack

The toolkit shows the attacker running systematic reconnaissance against the FortiGate appliance before weaponizing CVE-2024-21762 to gain remote code execution and an initial foothold on 3BB's internal network.

Reconnaissance and CVE Probing

Among the 298 recovered files were eight shell scripts purpose-built to fingerprint the target FortiGate's firmware version, probe for known flaws, and launch matching exploits automatically. The toolkit wasn't limited to a single vulnerability — it was built to probe several Fortinet and F5 BIG-IP CVEs in sequence:

This kind of "spray a checklist of known CVEs and see what lands" tooling is increasingly common among opportunistic intrusion crews — it lowers the skill bar and maximizes the odds that some unpatched appliance in a target's edge will be vulnerable.

Privilege Escalation, Persistence, and Cleanup

Once inside, the attacker escalated from an initial foothold to full root access using a combination of well-known Linux privilege-escalation exploits and custom tooling:

• PwnKit (CVE-2021-4034, Polkit pkexec local privilege escalation)
• Dirty COW (CVE-2016-5195, kernel race-condition privilege escalation)
• A dedicated SUID backdoor installer for re-establishing root access without needing to re-exploit
• SSH brute-force and password-spray utilities, used to expand access laterally across internal systems
• Database credential-harvesting scripts, along with captured VPN certificates and session cookies

For persistence, the attacker deployed MeshCentral, a legitimate open-source remote-management platform, configured as a covert command-and-control channel pointed at www.ayuthayatech[.]com. Because MeshCentral traffic resembles routine IT administration, it lets an intruder maintain long-term access without tripping the alarms a custom malware implant typically would.

The kit also included cleanup scripts designed to erase logs, delete exploitation artifacts and web shells, and clear shell history — while deliberately preserving the MeshCentral agent and the hidden SUID backdoor, so remediation efforts that "clean up" the obvious mess could still leave the attacker with a way back in.

Scope and Impact

Recovered device-enrollment records show the attacker reached root-level control of at least one internal 3BB server and expanded to dozens of additional machines. The primary objective appears to have been RADIUS databases — the systems that store subscriber authentication credentials for broadband logins — though Hunt.io found no independent confirmation that customer data was successfully exfiltrated.

The exposed cache also contained an OpenVPN configuration and session artifacts tied to Jasmine-branded infrastructure, a related Triple T Broadband environment, suggesting the intrusion — or a parallel campaign by the same actor — may extend beyond the core 3BB network. Hunt.io notes the available evidence does not independently confirm the full scope of that spillover.

Discovery and Disclosure

Hunt.io discovered the open directory while the operation was still live and notified 3BB and the relevant national CERT under TLP:AMBER ahead of public disclosure. The attacker has since closed the exposed staging directory, and the current state of access to 3BB's network is unknown.

Remediation and Hardening Recommendations

For any organization running Fortinet SSL-VPN — or any internet-facing VPN appliance — this intrusion is a reminder that edge devices remain a top initial-access target:

1. Patch CVE-2024-21762 immediately on all FortiGate appliances; if patching must be delayed, disable SSL-VPN entirely rather than relying on web-mode-only mitigations, which Fortinet has confirmed are insufficient.
2. Hunt for unauthorized MeshCentral agents or other legitimate remote-management tools that were not deployed by your own IT team.
3. Rotate every credential that may have been exposed: VPN certificates, RADIUS shared secrets, database credentials, SSH keys, application secrets, and privileged administrator passwords.
4. Search for hidden SUID binaries and unauthorized SSH keys, since attackers using PwnKit- or Dirty COW-style privilege escalation often plant secondary persistence that survives an initial cleanup.
5. Preserve forensic evidence before remediating — this attacker's own cleanup scripts show that removing "the obvious mess" first can destroy the evidence needed to confirm whether backdoors remain.
6. Monitor for connections to known indicators, including www.ayuthayatech[.]com and traffic to 92.63.180[.]133.

References

• SecurityWeek — Thai Broadband Provider Hacked via Fortinet Vulnerability

Related Reading

• 3BB Attacker Used MeshCentral Backdoor for Root Access to Subscriber Data
• ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks