# Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential Databases (CVE-2024-21762 Toolkit Staged)

> Hunt.io discovered an exposed attacker staging server (92.63.180.133:8888) revealing an active, root-level intrusion inside Thai broadband provider 3BB (Triple T Broadband), where MeshCentral remote-management software was repurposed as a hidden backdoor reporting to www.ayuthayatech.com. The attacker used the confirmed CVE-2020-1938 (Ghostcat) flaw to gain root on an internal Pentaho/Tomcat server, password-sprayed SSH across 55+ hosts, and staged scripts to exfiltrate 3BB's RADIUS subscriber-credential databases (radius_corp, radiusinfo, job_radius); a complete but unconfirmed CVE-2024-21762 FortiGate SSL-VPN exploit kit was also found staged against 3BB's own gateway.

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-09-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2514
- **ID:** TL-2026-2514
- **Severity:** HIGH (CVSS 9.8)
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-21762, CVE-2020-1938, CVE-2016-5195, CVE-2021-4034

## Description

In June 2026, threat-intelligence firm Hunt.io identified an open directory at 92.63.180.133:8888, hosted on Bangmod Enterprise infrastructure, belonging to an attacker actively operating inside the network of 3BB (Triple T Broadband), one of Thailand's largest broadband ISPs. The directory held 298 files across 30 subdirectories (19MB total) and functioned as the attacker's operational staging area while the intrusion remained live.

Recovered artifacts show the attacker achieved root-level command execution on at least one internal Linux application server by exploiting CVE-2020-1938 ("Ghostcat"), an Apache Tomcat AJP-connector file-read/inclusion flaw, against a Pentaho BI/Tomcat service at 10.11.152.4:8009. To maintain long-term access, the attacker deployed MeshCentral -- a legitimate open-source remote-management platform -- configured as a hidden backdoor (config file meshagent.msh, device group "TH-3BB") with agents running as root on multiple compromised hosts and reporting to a command server at www.ayuthayatech.com over port 443. A devices.json inventory recovered from the staging server catalogued enrolled hosts by hostname, IP, OS, and privilege level.

The attacker's primary objective centered on 3BB's RADIUS infrastructure: a recovered script (db_creds.sh) was purpose-built to copy out databases named radius_corp, radiusinfo, and job_radius -- the systems that store broadband-subscriber authentication credentials. Supporting tooling recovered from the staging server included SSH password-spraying utilities run against 55+ internal systems (using common passwords plus organization-specific combinations), a credential-harvesting script (cred_hunt.sh) targeting SSH private keys, PHP configuration files, database passwords, SNMP community strings, and command histories, a PHP web shell (/var/www/html/info.php) deployed via MySQL abuse, and local privilege-escalation exploits for CVE-2016-5195 (Dirty COW) and CVE-2021-4034 (PwnKit), plus a concealed SUID backdoor at /usr/local/bin/.rc. An anti-forensic cleanup script (cleanup_target.sh) deleted exploitation files, web shells, authentication/system logs, and shell histories -- while deliberately preserving both the MeshCentral agent and the hidden SUID backdoor, indicating the actor planned to retain access after cleanup.

The staging server also held a complete exploit toolkit for CVE-2024-21762, a critical (CVSS 9.8) unauthenticated out-of-bounds write in FortiOS/FortiProxy SSL-VPN, targeting 3BB's own FortiGate 60F gateway at mail.3bb.co.th:10443. Eight reconnaissance scripts fingerprinted the VPN service, inspected HTTP headers, and probed for historical vulnerabilities using controlled crashes and malformed chunked HTTP requests; a further stage combined heap spraying with an ROP chain intended to launch a reverse shell to the staging server's port 9443, and the attacker sought FortiOS 7.2.5 firmware to derive model/version-specific ROP gadgets. Hunt.io found no evidence this exploit chain was ever executed against the live gateway.

Additional recovered artifacts point to broader targeting: probing of the internal CodeIgniter-based sales/agent portal (agent.3bb.co.th, behind an F5 BIG-IP at 110.164.192.228) for authentication bypass, session forgery, file upload, SQL injection, path traversal, SSRF, and HTTP request smuggling; and an OpenVPN profile (jasmine.ovpn) containing a certificate and private key issued under 3BB's own PKI for a formerly-affiliated "Jasmine" network entity (VPN endpoint 110.164.129.67:443), with evidence of active login sessions -- suggesting concurrent targeting of that adjacent infrastructure. No threat-actor attribution was published. Hunt.io notified 3BB and relevant national cybersecurity response teams prior to public disclosure on 2026-09-14.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1078 Valid Accounts
- T1548.001 Setuid and Setgid
- T1685.006 Clear Linux or Mac System Logs
- T1070.003 Clear Command History
- T1110.003 Password Spraying
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1021.004 SSH
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1071.001 Web Protocols

## Sources

- [3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials](https://thehackernews.com/2026/09/3bb-attacker-used-meshcentral-backdoor.html)
- [Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider](https://cybersecuritynews.com/fortigate-ssl-vpn-vulnerability/)
- [Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor](https://gbhackers.com/hackers-exploit-fortigate-ssl-vpn-flaw/)
- [Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor](https://cyberpress.org/hackers-exploit-fortigate-ssl-vpn-flaw-to-breach-thai-isp-and-deploy-meshcentral-backdoor/)
- [Open directory exposes live ISP intrusion, RADIUS subscriber creds the objective](https://radar.offseq.com/threat/open-directory-exposes-live-isp-intrusion-radius-subscriber-creds-the-objective-b0d26aa491bcca48)
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2024-21762)](https://www.cisa.gov/news-events/alerts/2024/02/09/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CVE-2024-21762 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-21762)
- [FortiOS - Out-of-bound write in sslvpnd (FG-IR-24-015)](https://fortiguard.com/psirt/FG-IR-024-015)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2514