An attacker kept root inside Thai broadband provider 3BB with a hidden MeshCentral install

MeshCentral is free, and it is what an IT team would install to manage computers remotely ^[4]. The recovered settings show the agents set to run hidden, checking in to a control server the attacker operated at www.ayuthayatech[.]com under a device group named TH-3BB ^[5]. Hunt.io said attackers increasingly abuse this kind of software because it is trusted and its activity blends in with routine administration ^[6].

Responders should read the cleanup script closely. It erased logs and deleted the attacker's other tools, and it left the MeshCentral agent in place on purpose so the access would survive ^[8]. Several machines on the recovered device list were connected and running with root privileges when the list was made, and the researchers said that showed the attacker held active administrative control at that point ^[7].

Inside the network the operator sprayed passwords over SSH against more than 55 internal computers and probed the internal sales portal at agent.3bb.co[.]th. Compromised machines were searched for stored passwords, database logins and SSH keys ^[9]. Other scripts could plant web shells and add SSH keys as backup ways back in ^[10]. The same server held a valid VPN certificate from 3BB's own systems and active login sessions for services on the Jasmine network. 3BB was once part of Jasmine and still shares infrastructure with it. Hunt.io said this suggested the attacker was working against both, and it stopped short of saying Jasmine itself had been breached ^[12].

How the attacker first got in is not established ^[13]. The most developed part of the kit targeted a 3BB FortiGate SSL-VPN gateway at mail.3bb.co[.]th, and it held a complete exploit for CVE-2024-21762. That 2024 Fortinet flaw lets an attacker run code on the device without logging in. The targeted gateway was running an affected firmware version ^[14]. Hunt.io recovered no sign that the exploit ran or that it was the way in ^[15]. A gateway still on vulnerable firmware when the server was captured in June 2026 is about two years of exposure on the box the attacker was aiming at ^[21].

Fortinet's advisory says that if you cannot patch at once you should turn off SSL-VPN, and that turning off web mode alone is not a valid workaround ^[18]. Patching does not remove an agent that is already installed or reset a password that has already been exposed ^[20]. Hunt.io's remediation list runs to SSH keys, database and RADIUS passwords, VPN certificates and application secrets, alongside a hunt for MeshCentral agents and management servers that are not in inventory ^[19][20].

The attacker has since closed the exposed directory. The evidence describes the intrusion as it stood in early June, so whether the access inside 3BB still holds is an open question ^[16]. Hunt.io said it notified the affected companies and the relevant national response team before publishing ^[17].