An attacker infiltrated the network of Thailand's largest broadband provider, 3BB, using a legitimate management tool called MeshCentral. Threat intelligence firm Hunt.io revealed the breach by analyzing a server the attacker had left accessible on the internet, which contained their own tools and a list of machines they already controlled. The tools on it were executed from within 3BB's own network, and one recovered file revealed the attacker gained full administrative control, commonly referred to as root access, of an internal server.
They employed scripts that transmitted passwords to over 55 internal computers via SSH, explored the 3BB internal sales portal at agent.3bb.co[. ]th, and probed for stored passwords, database logins, and SSH keys on compromised machines.
The server had a comprehensive toolkit designed for a 3BB FortiGate SSL-VPN gateway, including a complete exploit for a serious 2024 Fortinet vulnerability that allows attackers to run code on the device without requiring login. ### What Defenders Should Do The recovered toolkit points to a clear set of steps for organizations running similar edge devices and authentication systems: Verify that FortiGate SSL-VPN appliances are secure against CVE-2024-21762. 2.
Rotate any credentials, including SSH keys, database and RADIUS passwords, VPN certificates, and application secrets. Search for sneaky ways back in, like unexpected SUID files, web shells, changed SSH keys, and newly added remote-management software.
