Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential Databases (CVE-2024-21762 Toolkit Staged)

Key facts for 3BB Thai ISP MeshCentral backdoor

Detection coverage for 3BB Thai ISP MeshCentral backdoor

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2514 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SSH Password Spray Against Internal Host Population (55+ Targets)

Detects a single source authenticating (or attempting to authenticate) against a large number of distinct internal SSH hosts with a low-diversity username set in a short window, consistent with the attacker's password-spraying campaign across 55+ internal systems.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1110.003, T1021.004, T1046
• Data sources: Linux secure/auth logs (sshd), network flow (SSH port 22), bastion/jump-host session logs
• Severity: high
• Confidence: high

Splunk SPL

index=linux_secure sourcetype=linux_secure "Failed password" OR "Accepted password"
| rex field=_raw "(?<result>Failed|Accepted) password for (invalid user )?(?<user>\S+) from (?<src_ip>[\d\.]+)"
| bin _time span=15m
| stats dc(host) as distinct_hosts dc(user) as distinct_users count as attempts values(result) as results by src_ip _time
| where distinct_hosts > 10 AND (distinct_users <= 5 OR attempts > 50)

Microsoft KQL

DeviceLogonEvents
| where Timestamp > ago(24h)
| where Protocol == "SSH" or LogonType == "Network"
| summarize DistinctHosts=dcount(DeviceName), DistinctAccounts=dcount(AccountName), Attempts=count(), FailedCount=countif(ActionType=="LogonFailed") by RemoteIP, bin(Timestamp,15m)
| where DistinctHosts > 10 and (DistinctAccounts <= 5 or Attempts > 50)

Sigma

title: SSH Password Spraying Across Many Internal Hosts
id: f6b8c0d2-4e5a-4f7b-c9d0-e1f2a3b4c5d6
status: experimental
description: Detects a single source IP attempting SSH authentication against a large number of distinct internal hosts within a short window using a small set of usernames, consistent with a password-spraying campaign.
references:
    - https://radar.offseq.com/threat/open-directory-exposes-live-isp-intrusion-radius-subscriber-creds-the-objective-b0d26aa491bcca48
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
    - attack.credential-access
    - attack.t1110.003
    - attack.lateral-movement
    - attack.t1021.004
    - attack.discovery
    - attack.t1046
logsource:
    category: authentication
    product: linux
    service: sshd
detection:
    selection:
        logsource.category: 'authentication'
        Application: 'sshd'
    timeframe: 15m
    condition: selection | count(DestinationHostname) by SourceIP > 10
falsepositives:
    - Authorized centralized configuration-management/orchestration systems (Ansible, SaltStack) that legitimately connect to many hosts via SSH in short succession
level: high

Known false positives:

• Authorized configuration-management/orchestration platforms (Ansible, SaltStack, Rundeck) connecting to many hosts via SSH in short succession using a service account
• Vulnerability scanners performing authenticated SSH checks across the fleet

Tuning notes: Allowlist known automation/orchestration service-account source IPs; tighten the distinct_hosts threshold in smaller environments and require the low-username-diversity condition to reduce false positives from legitimate fleet-wide SSH tooling.

• 🔒 FortiGate SSL-VPN CVE-2024-21762 Reconnaissance and Exploitation Fingerprinting · unlock with TL Creds
• 🔒 RADIUS Database Exfiltration Script and Credential-Harvesting Toolkit Execution · unlock with TL Creds
• 🔒 MeshCentral C2 Beacon Traffic to [indicator] / Staging Server Reverse-Shell Port · unlock with TL Creds
• 🔒 Anomalous Shell Spawned from Tomcat/Java Process (Post-Ghostcat Exploitation) · unlock with TL Creds
• 🔒 Hidden SUID Backdoor Creation with Coincident Anti-Forensic Log Clearing · unlock with TL Creds
• 🔒 Post-Compromise SSH Lateral Movement with System/Network Discovery Commands · unlock with TL Creds
• 🔒 Ghostcat (CVE-2020-1938) AJP Connector Exploitation Against Internal Tomcat/Pentaho · unlock with TL Creds
• 🔒 MeshCentral Agent Deployed and Running as Root (Unauthorized RMM Backdoor) · unlock with TL Creds

Indicators of compromise for 3BB Thai ISP MeshCentral backdoor

As of 2026-09-15, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2514.

Sample indicators (3 of 24)

• IP address: 92.63.180[.]133
• Domain: www[.]ayuthayatech[.]com
• IP address: 110.164.192[.]228

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How 3BB Thai ISP MeshCentral backdoor works

The attacker used the confirmed CVE-2020-1938 (Ghostcat) flaw to gain root on an internal Pentaho/Tomcat server, password-sprayed SSH across 55+ hosts, and staged scripts to exfiltrate 3BB's RADIUS subscriber-credential databases (radius_corp, radiusinfo, job_radius); a complete but unconfirmed CVE-2024-21762 FortiGate SSL-VPN exploit kit was also found staged against 3BB's own gateway.

In June 2026, threat-intelligence firm Hunt.io identified an open directory at 92.63.180.133:8888, hosted on Bangmod Enterprise infrastructure, belonging to an attacker actively operating inside the network of 3BB (Triple T Broadband), one of Thailand's largest broadband ISPs. The directory held 298 files across 30 subdirectories (19MB total) and functioned as the attacker's operational staging area while the intrusion remained live.

Recovered artifacts show the attacker achieved root-level command execution on at least one internal Linux application server by exploiting CVE-2020-1938 ("Ghostcat"), an Apache Tomcat AJP-connector file-read/inclusion flaw, against a Pentaho BI/Tomcat service at 10.11.152.4:8009. To maintain long-term access, the attacker deployed MeshCentral -- a legitimate open-source remote-management platform -- configured as a hidden backdoor (config file meshagent.msh, device group "TH-3BB") with agents running as root on multiple compromised hosts and reporting to a command server at www.ayuthayatech.com over port 443. A devices.json inventory recovered from the staging server catalogued enrolled hosts by hostname, IP, OS, and privilege level.

The attacker's primary objective centered on 3BB's RADIUS infrastructure: a recovered script (db_creds.sh) was purpose-built to copy out databases named radius_corp, radiusinfo, and job_radius -- the systems that store broadband-subscriber authentication credentials. Supporting tooling recovered from the staging server included SSH password-spraying utilities run against 55+ internal systems (using common passwords plus organization-specific combinations), a credential-harvesting script (cred_hunt.sh) targeting SSH private keys, PHP configuration files, database passwords, SNMP community strings, and command histories, a PHP web shell (/var/www/html/info.php) deployed via MySQL abuse, and local privilege-escalation exploits for CVE-2016-5195 (Dirty COW) and CVE-2021-4034 (PwnKit), plus a concealed SUID backdoor at /usr/local/bin/.rc. An anti-forensic cleanup script (cleanup_target.sh) deleted exploitation files, web shells, authentication/system logs, and shell histories -- while deliberately preserving both the MeshCentral agent and the hidden SUID backdoor, indicating the actor planned to retain access after cleanup.

The staging server also held a complete exploit toolkit for CVE-2024-21762, a critical (CVSS 9.8) unauthenticated out-of-bounds write in FortiOS/FortiProxy SSL-VPN, targeting 3BB's own FortiGate 60F gateway at mail.3bb.co.th:10443. Eight reconnaissance scripts fingerprinted the VPN service, inspected HTTP headers, and probed for historical vulnerabilities using controlled crashes and malformed chunked HTTP requests; a further stage combined heap spraying with an ROP chain intended to launch a reverse shell to the staging server's port 9443, and the attacker sought FortiOS 7.2.5 firmware to derive model/version-specific ROP gadgets. Hunt.io found no evidence this exploit chain was ever executed against the live gateway.

Additional recovered artifacts point to broader targeting: probing of the internal CodeIgniter-based sales/agent portal (agent.3bb.co.th, behind an F5 BIG-IP at 110.164.192.228) for authentication bypass, session forgery, file upload, SQL injection, path traversal, SSRF, and HTTP request smuggling; and an OpenVPN profile (jasmine.ovpn) containing a certificate and private key issued under 3BB's own PKI for a formerly-affiliated "Jasmine" network entity (VPN endpoint 110.164.129.67:443), with evidence of active login sessions -- suggesting concurrent targeting of that adjacent infrastructure. No threat-actor attribution was published. Hunt.io notified 3BB and relevant national cybersecurity response teams prior to public disclosure on 2026-09-14.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021.004 SSH

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059.004 Unix Shell

Stealth

T1070.003 Clear Command History

Command and Control

T1071.001 Web Protocols; T1219 Remote Access Tools

Persistence

T1078 Valid Accounts; T1505.003 Web Shell

Credential Access

T1110.003 Password Spraying; T1552.001 Credentials In Files; T1552.004 Private Keys

Initial Access

T1190 Exploit Public-Facing Application

Privilege Escalation

T1548.001 Setuid and Setgid

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

defense-impairment

T1685.006 Clear Linux or Mac System Logs

Remediation for 3BB Thai ISP MeshCentral backdoor

Patches

• Fortinet PSIRT FG-IR-24-015 (CVE-2024-21762)
• Apache Tomcat 9.0.31+ / 8.5.51+ / 7.0.100+ (CVE-2020-1938)
• Linux kernel copy-on-write race-condition patch (CVE-2016-5195)
• polkit pkexec patch (CVE-2021-4034)

Immediate actions

• Patch/upgrade all FortiGate SSL-VPN appliances per Fortinet PSIRT advisory FG-IR-24-015 and confirm the mail.3bb.co.th gateway is on a fixed FortiOS build
• Hunt for and remove unauthorized MeshCentral agents reporting to www.ayuthayatech.com; treat any RMM client not deployed by IT as a hostile backdoor
• Hunt for and remove hidden SUID binaries such as /usr/local/bin/.rc across all Linux hosts
• Rotate all RADIUS/subscriber credentials and force re-enrollment given confirmed targeting of the radius_corp, radiusinfo, and job_radius databases
• Revoke and reissue the OpenVPN certificate/key pair referenced in the recovered jasmine.ovpn profile

Workarounds

• Disable SSL-VPN on FortiGate devices where immediate patching is not possible
• Disable or restrict the AJP connector to localhost if not required

Longer-term hardening

• Disable or restrict the Tomcat AJP connector on Pentaho/BI deployments per CVE-2020-1938 (Ghostcat) guidance
• Enforce SSH key-based authentication with account lockout/rate-limiting to blunt password-spray campaigns
• Deploy EDR/host-integrity monitoring capable of detecting SUID abuse, hidden RMM agents, and unauthorized web shells
• Segment RADIUS and subscriber-credential database systems from general application/web-tier network segments

Affected and fixed versions

• Fortinet — FortiOS / FortiProxy SSL-VPN
  Vulnerable versions: 6.0.0-6.0.17; 6.2.0-6.2.15; 6.4.0-6.4.14; 7.0.0-7.0.13; 7.2.0-7.2.6; 7.4.0-7.4.2
  Fixed in: See Fortinet PSIRT FG-IR-24-015 for the fixed release per branch
• 3BB / Triple T Broadband — FortiGate 60F SSL-VPN gateway (mail.3bb.co.th)
  Vulnerable versions: Attacker toolkit targeted FortiOS 7.2.5-era firmware; exploitation against this device unconfirmed
• Apache — Apache Tomcat AJP Connector (internal Pentaho BI Server deployment) — CVE-2020-1938 / Ghostcat
  Vulnerable versions: Tomcat < 9.0.31; Tomcat < 8.5.51; Tomcat < 7.0.100
  Fixed in: 9.0.31+; 8.5.51+; 7.0.100+
• Linux kernel — Copy-on-write memory subsystem — CVE-2016-5195 / Dirty COW (recovered local privilege-escalation exploit)
  Vulnerable versions: Kernel versions prior to the October 2016 fix
  Fixed in: Patched kernel releases from October 2016 onward
• polkit — pkexec — CVE-2021-4034 / PwnKit (recovered local privilege-escalation exploit)
  Vulnerable versions: All polkit releases prior to the May 2021 patch
  Fixed in: Patched releases from May 2021 onward

Timeline of 3BB Thai ISP MeshCentral backdoor

• 2024-02-08 Fortinet discloses CVE-2024-21762, a critical (CVSS 9.8) out-of-bounds write in FortiOS/FortiProxy SSL-VPN enabling unauthenticated remote code execution (PSIRT FG-IR-24-015).
• 2024-02-09 CISA adds CVE-2024-21762 to the Known Exploited Vulnerabilities catalog, citing confirmed in-the-wild exploitation.
• 2026-06-03 locked-ioc-9 recovered, showing deletion of exploitation files, web shells, and logs/histories while deliberately preserving the locked-ioc-23 agent and hidden SUID backdoor at locked-ioc-7.
• 2026-06-03 A complete but unconfirmed CVE-2024-21762 exploit chain (VPN fingerprinting, heap-spray/ROP reverse-shell stage) is found staged against 3BB's own FortiGate 60F gateway at locked-ioc-12:10443.
• 2026-06-03 Recovered locked-ioc-22 script found purpose-built to copy out the radius_corp, radiusinfo, and job_radius subscriber-credential databases.
• 2026-06-03 Staging server contains locked-ioc-16 configuration for device group "TH-3BB" reporting to locked-ioc-6:443, confirming locked-ioc-23 deployed as a hidden root-privileged backdoor across multiple compromised hosts.
• 2026-06-03 Recovered artifacts show CVE-2020-1938 (Ghostcat) used against the internal Pentaho/Tomcat AJP service at locked-ioc-21:8009, achieving root-level command execution on the application server.
• 2026-06-03 locked-ioc-24 first indexes the attacker's open directory at locked-ioc-14:8888 (298 files, 30 subdirectories, 19MB), hosted on locked-ioc-8 infrastructure, with the intrusion still active.
• 2026-09-14 locked-ioc-24 publishes findings via The Hacker News after notifying 3BB and relevant national cybersecurity response teams.

Sources cited for 3BB Thai ISP MeshCentral backdoor

• CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2024-21762) CISA · Government advisory · 2024-02-09
• CVE-2024-21762 Detail NVD (NIST) · Advisory · 2024-02-09
• Open directory exposes live ISP intrusion, RADIUS subscriber creds the objective radar.offseq.com · Research · 2026-09-14
• FortiOS - Out-of-bound write in sslvpnd (FG-IR-24-015) FortiGuard Labs · Vendor report · 2024-02-08
• 3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials The Hacker News · News · 2026-09-14
• Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider cybersecuritynews.com · News · 2026-09-14
• Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor gbhackers.com · News · 2026-09-14
• Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor cyberpress.org · News · 2026-09-14

More in data breach

• Chainalysis breach via agentic on-path (AitM) attack exposes user credentials and live authentication tokens
• DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail Credentials
• WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework
• Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
• Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data

Other reports on CVE-2024-21762

• Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions
• Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany; Qilin Affiliate Exploited Check Point VPN Zero-Day CVE-2026-50751
• CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)
• FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)
• StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike
• FortiBleed Credential Theft Campaign Linked to INC and Lynx Ransomware Operations

Other reports on CVE-2020-1938

• CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce Platforms
• Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage Campaign

Previous and next in data breach

• Revolut Discloses Data Breach via Government-Impersonation Social Engineering, Exposing Customer Financial and Passport Data Previous report
• Gyazo Data Breach: Helpfeel Discloses 23.62M User Records and ~492M Image Metadata Records Exposed via Image Upload Server Exploit Next report