Security1 publisher2 min readPublished
Open staging directory documents a CVE-2024-21762 intrusion at Thai carrier 3BB
Hunt.io says a threat actor left 298 files in an open directory in Thailand, including FortiGate and F5 exploit scripts written for 3BB and a MeshCentral backdoor that the cleanup script checked was still running.
The Watch · Security desk
What happened
- Hunt.io found the operation's staging directory open on Thai infrastructure, holding 298 files across 30 subdirectories, including exploit scripts, privilege escalation tools and an inventory of compromised machines.
- Eight shell scripts fingerprinted the FortiGate SSL-VPN appliance and confirmed its firmware version, after which the actor deployed an exploit for CVE-2024-21762 to get remote code execution.
- In parallel the actor probed 3BB's F5 BIG-IP for CVE-2021-22986, CVE-2022-1388 and CVE-2023-46747, and probed the internal sales agent portal running behind the load balancer.
- On Linux hosts the actor reached for root with PwnKit, Dirty COW and a dedicated SUID backdoor installer, then ran MeshCentral as its command-and-control platform.
- A final script deleted exploitation artifacts, PHP web shells, MeshCentral deployment scripts and system logs, then checked that the hidden SUID binary and the MeshCentral service were still live.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The harvesting list sets the recovery scope for 3BB: SSH keys, database credentials, SNMP community strings and Radius authentication data have to be treated as lost estate-wide, beyond the hosts that were rooted.
- constraint Signature-based detection misses this actor, because the access it kept was a remote administration platform running as a service.
- precedent Every exploit in the directory targets a published CVE, so the same scripts work against any operator sitting at the same patch level on Fortinet or F5 edge kit.
Seven published CVEs sat in one directory, four Fortinet identifiers and three F5 identifiers [7][8][16]. The oldest is CVE-2018-13379 [7]. The Fortinet identifier years alone span 2018 to 2024 [17]. None of this needed a zero-day, just an SSL-VPN appliance that had not been updated, and 3BB's answered to CVE-2024-21762 with remote code execution [7].
Version confirmation came before exploitation [6]. A kit maintained against a specific estate behaves that way. Hunt.io says the file naming supports that reading: "The files were tagged across operational categories such as Exploit, Victim, Config, and History, consistent with an active staging environment," the firm said [4].
The persistence layer was MeshCentral, a remote administration tool. "After successful host compromise, the actor established persistent remote access using MeshCentral as a command-and-control (C&C) platform for remote administration," Hunt.io said [10].
The harvesting scripts went after SSH keys, PHP configurations, database credentials, SNMP community strings and Radius authentication data, and attempted passwordless MySQL authentication against internal databases [12]. Two further scripts read sensitive files, deployed PHP web shells, injected SSH keys and modified database privileges, which Hunt.io says gave the actor "multiple mechanisms for persistence and lateral movement across the environment" [13].
Then the cleanup. "The script concludes by verifying that persistence mechanisms remain operational, including checking the hidden SUID binary and confirming the MeshCentral service is still running. This demonstrates that the cleanup process was intended to conceal the intrusion while ensuring continued remote access to compromised systems," Hunt.io said [15]. System logs were among the things the same script removed [14]. A responder rebuilding this timeline from syslog is working from a set the actor curated.
Hunt.io did not date the intrusion or say how long the access lasted [18]. Hunt.io says the tooling was crafted specifically for 3BB, one of the largest fixed-line broadband providers in Thailand with millions of users, and for Jasmine, the company that previously owned Triple T Broadband [5].
What to watch
- Whether 3BB or Jasmine confirms the compromise and states what subscriber data was reachable.
- Whether the same staging kit or MeshCentral infrastructure turns up against other regional carriers, which would move this from one intrusion to a campaign.
- Whether Hunt.io publishes indicators for the MeshCentral instance and the hidden SUID binary so other operators can hunt for them.