Thai Broadband Provider 3BB Targeted in MeshCentral Backdoor Attack
Cybersecurity researchers have uncovered an active intrusion inside the network of 3BB, one of Thailand’s largest broadband providers. The attacker used MeshCentral, a legitimate remote-management tool, to maintain control of internal systems.
Threat intelligence firm Hunt.io discovered the operation after finding an exposed server containing the attacker’s tools, compromised-machine records, and scripts used to expand access.
Exposed Server Revealed Active Intrusion
Hunt.io captured the server on June 3, 2026, while the operation was still active. The tools stored on the server had been executed from a computer inside 3BB’s network.
One recovered file showed that the attacker had obtained full administrative, or root, access to an internal server.
The attacker then installed MeshCentral, a tool commonly used by IT teams to remotely manage computers. However, the recovered configuration showed that it had been deployed as a hidden backdoor.
The MeshCentral agents connected to an attacker-controlled server at:
www.ayuthayatech[.]com
The agents were placed in a device group named:
TH-3BB
Remote-management tools such as MeshCentral are increasingly abused by attackers because they are legitimate software and their activity can appear similar to normal IT administration.
Multiple Internal Systems Under Control
A device list recovered from the exposed server identified machines enrolled in the attacker’s MeshCentral environment.
Several systems were connected and running with root privileges when the list was created. According to Hunt.io, this indicated that the attacker had active administrative control over those devices.
The attacker also used a cleanup script to remove logs and delete other tools from compromised systems. However, the script deliberately left the MeshCentral agent installed so that remote access could continue.
Password Attacks and Internal Reconnaissance
After gaining a foothold, the attacker attempted to expand access across 3BB’s internal network.
Recovered scripts were capable of:
- Spraying passwords against more than 55 internal computers over SSH.
- Probing 3BB’s internal sales portal at
agent.3bb.co[.]th. - Searching compromised systems for stored passwords and database credentials.
- Looking for SSH keys that could provide additional access.
- Installing web shells that could execute attacker-controlled commands.
- Adding new SSH keys as backup access methods.
These activities indicate that the attacker was attempting to move laterally and establish multiple ways to return to compromised systems.
Subscriber Authentication Databases Targeted
Hunt.io said the attacker’s primary objective appeared to be 3BB subscriber data.
Scripts stored on the exposed server were designed to copy the company’s RADIUS databases. These databases contain authentication information used by broadband customers to connect to the internet.
The evidence shows that the databases were targeted. However, Hunt.io did not confirm that any subscriber data was successfully stolen.
Possible Connection to the Jasmine Network
The exposed server also contained a valid VPN certificate from 3BB’s systems, along with active login sessions for services on the Jasmine network.
3BB was previously part of Jasmine and continues to share some infrastructure with the company.
Hunt.io said the evidence suggested that the attacker may have been targeting both organizations. However, the researchers did not confirm that Jasmine itself had been compromised.
FortiGate SSL-VPN Exploit Found in the Toolkit
The initial access method remains unknown.
The exposed server contained a complete toolkit targeting a 3BB FortiGate SSL-VPN gateway at:
mail.3bb.co[.]th
The toolkit included an exploit for CVE-2024-21762, a critical Fortinet vulnerability that can allow unauthenticated attackers to execute code on affected devices.
The targeted gateway was running firmware believed to be vulnerable to the flaw.
However, Hunt.io found no evidence that the exploit successfully compromised the FortiGate device or that it was the method used to enter 3BB’s network.
The FortiGate tools were the most developed part of the attacker’s toolkit, but they demonstrate capability and intent rather than confirmed exploitation.
Attacker Closed the Exposed Directory
The attacker has since closed the exposed directory.
It is not known whether the attacker still has access to 3BB’s network. The evidence collected by Hunt.io describes the intrusion as it existed in early June 2026 and does not establish the attacker’s current status.
The researchers said they notified the affected organizations and the relevant national incident-response team before publishing their findings.
What Organizations Should Do
Organizations using similar network appliances, authentication systems, or remote-management tools should take the following steps:
- Patch FortiGate SSL-VPN appliances against CVE-2024-21762. If immediate patching is not possible, Fortinet recommends disabling SSL-VPN. Disabling web mode alone is not a valid workaround.
- Search for unauthorized MeshCentral agents and connections to unknown management servers.
- Rotate potentially exposed credentials, including SSH keys, database passwords, RADIUS credentials, VPN certificates, and application secrets.
- Search for persistence mechanisms, including unexpected SUID files, web shells, modified SSH keys, and newly installed remote-management tools.
- Preserve logs and forensic evidence before beginning cleanup, as attackers may use scripts designed to erase traces of their activity.
Indicators of Compromise
The following indicators were reported in defanged form:
- Attacker IP address:
92.63.180[.]133 - Open directory port:
8888 - Exploit callback port:
9443 - MeshCentral control server:
www.ayuthayatech[.]com - MeshCentral device group:
TH-3BB - Hidden backdoor:
/usr/local/bin/.rc - MeshCentral agent path:
/usr/local/mesh_services/meshagent/ - FortiGate SSL-VPN target:
mail.3bb.co[.]th - Internal sales portal:
agent.3bb.co[.]th
