How a Threat Actor Compromised Thailand’s 3BB Broadband Network Using MeshCentral and Targeted RADIUS Databases

In June 2026, threat intelligence specialists at Hunt.io uncovered a sophisticated, stealthy cyber intrusion targeting 3BB, one of Thailand’s premier broadband service providers. The malicious actor successfully infiltrated the telecom giant’s internal network, maintaining deep administrative access and remote control over critical enterprise machinery. Rather than relying solely on custom malware, the operator abused legitimate, trusted software tools—specifically MeshCentral—to blend in with routine administrative traffic and evade traditional security tripwires.

The ongoing campaign, which came to light through an exposed attacker-controlled server discovered on June 3, 2026, underscores a troubling trend in modern cyber warfare: the weaponization of dual-use remote management tools. As threat actors pivot toward living-off-the-land techniques, identifying and mitigating these stealthy intrusions has become a paramount challenge for critical infrastructure providers worldwide.

Uncovering the Breach: The Exposed Server Discovery

The security incident first came into focus when researchers at Hunt.io identified an unsecured, publicly accessible server left open on the internet by the threat actor. Upon examining the contents of this inadvertent exposure, investigators discovered a treasure trove of operational tooling, scripts, and logs that offered a comprehensive view of the attacker’s methodology inside 3BB’s architecture.

Among the recovered artifacts was a live record of machines already subjugated under the attacker’s administrative control. A detailed device list explicitly named the internal systems enrolled in the perpetrator’s command infrastructure. At the time the snapshot was captured by researchers, several of these internal servers were actively running with root privileges—the highest level of administrative access—confirming that the attacker possessed persistent, high-level control over critical network segments.

Further analysis of the exposed server revealed a calculated cleanup script designed to erase system logs and purge the attacker’s secondary utilities. Notably, however, the script was intentionally programmed to leave the remote management mechanism intact, ensuring that the adversary’s backdoor access would survive routine security sweeps and incident response efforts.

The Anatomy of the Attack: Leveraging MeshCentral for Persistence

To maintain a persistent foothold without triggering alerts, the intruder deployed MeshCentral, an open-source, legitimate remote monitoring and management (RMM) utility routinely utilized by system administrators to oversee computer networks. By configuring MeshCentral as a hidden backdoor, the attacker could issue commands, execute scripts, and manage compromised assets remotely through standard HTTPS channels.

Forensic examination of the recovered configuration files indicated that the MeshCentral agents were configured to report back to an external command-and-control (C2) server operated by the attacker via the domain www.ayuthayatech[.]com. Within the MeshCentral panel, the compromised assets were neatly organized under a specific device group labeled TH-3BB.

The abuse of dual-use software like MeshCentral highlights a significant blind spot in many corporate security postures. Because network monitoring tools often generate high volumes of legitimate outbound traffic, security operations center (SOC) analysts frequently struggle to distinguish between authorized administrative oversight and malicious command-and-control communication.

Lateral Movement and Surveillance Tactics

Once inside the 3BB network perimeter, the threat actor wasted little time expanding their footprint and gathering intelligence. Recovered execution scripts demonstrated a methodical approach to lateral movement and credential harvesting.

The intruder executed automated password-spraying scripts targeting over 55 internal computers via the Secure Shell (SSH) protocol. Concurrently, they probed internal corporate assets, including 3BB’s internal sales portal located at agent.3bb.co[.]th. The attacker’s toolkit also featured utilities designed to scour compromised machines for cached credentials, database authentication strings, and SSH private keys. To cement their access further, scripts were deployed to plant web shells—hidden malicious web scripts that allow attackers to execute arbitrary commands via a browser interface—and inject unauthorized SSH keys into system configurations as redundant backdoors.

Primary Objective: Targeting Subscriber RADIUS Databases

While the intrusion involved extensive network reconnaissance and lateral movement, threat intelligence analysts determined that the adversary’s primary objective centered on subscriber data.

Scripts discovered on the attacker’s server were specifically engineered to query, stage, and exfiltrate data from 3BB’s Remote Authentication Dial-In User Service (RADIUS) databases. These critical database systems store sensitive customer authentication credentials, subscription details, and session data required to authenticate broadband subscribers onto the internet.

While Hunt.io’s analysis confirmed that the RADIUS databases were actively targeted and prepped for extraction, investigators noted that definitive evidence of successful data exfiltration was absent from the recovered server logs. Nevertheless, the potential compromise of a major telecom provider’s subscriber authentication infrastructure poses grave risks regarding identity theft, credential stuffing attacks, and subsequent targeted phishing campaigns against millions of broadband customers.

Cross-Network Probing: The Jasmine Connection

The scope of the security incident extended beyond 3BB’s immediate corporate perimeter. Investigators examining the exposed attacker server uncovered valid Virtual Private Network (VPN) certificates issued by 3BB systems alongside active login sessions tied to services operated by the Jasmine International Public Company Limited (Jasmine).

3BB was historically a core business unit under the Jasmine corporate umbrella, and both entities continue to share significant telecommunications infrastructure and enterprise networking resources. The presence of Jasmine network credentials and active authentication tokens strongly implies that the threat actor was concurrently targeting Jasmine’s infrastructure, raising concerns over a broader cascading breach across interconnected Thai corporate networks. However, security researchers have not formally confirmed whether Jasmine’s independent perimeter was successfully breached during the operation.

The Initial Vector: FortiGate SSL-VPN and CVE-2024-21762

A lingering question throughout the investigation was how the threat actor initially breached 3BB’s network perimeter. While conclusive proof of the entry point remains elusive due to the retrospective nature of the analysis, evidence recovered from the attacker’s toolkit points heavily toward a prominent edge device vulnerability.

The exposed server housed a comprehensive exploitation framework specifically tailored for Fortinet FortiGate SSL-VPN gateways, targeting the corporate remote-access endpoint located at mail.3bb.co[.]th. The toolkit included a fully functional exploit script for CVE-2024-21762, a critical security flaw originally disclosed in early 2024. This vulnerability allows unauthenticated remote attackers to execute arbitrary code or commands on vulnerable appliances via specially crafted HTTP requests.

Technical audits of the targeted 3BB gateway revealed that the device was indeed running a firmware version vulnerable to CVE-2024-21762 at the time of the incident. Although Hunt.io emphasized that the presence of the exploit toolkit demonstrates capability and intent rather than a confirmed initial breach method, the sophistication of the tooling underscores the persistent danger unpatched perimeter hardware poses to telecommunications infrastructure.

Implications for Critical Infrastructure and Cybersecurity Defenses

The 3BB security incident serves as a stark reminder of the evolving threats confronting telecommunications operators and critical service providers. Telecom companies possess vast amounts of sensitive customer data, intellectual property, and high-bandwidth network access, making them prime targets for both state-sponsored espionage groups and financially motivated cybercrime syndicates.

The weaponization of administrative software like MeshCentral demonstrates that perimeter defenses alone are no longer sufficient to secure enterprise networks. Once an attacker bypasses the initial barrier—whether via a compromised VPN appliance, stolen credentials, or a zero-day vulnerability—they can easily weaponize native administrative utilities to mimic legitimate workflows and maintain persistence indefinitely.

Following the completion of their analysis, Hunt.io researchers responsibly disclosed their findings to the affected corporate entities and relevant national computer emergency response teams (CERTs) prior to public disclosure, allowing institutional defenders to isolate compromised endpoints and revoke illicit access tokens.

Recommended Remediation and Defense Strategies

In the wake of the 3BB intrusion, cybersecurity experts and incident response frameworks emphasize a rigorous set of defensive measures for organizations managing similar edge devices, remote authentication systems, and enterprise networks:

• Strict Monitoring of Remote Management Tools: Organizations must audit and baseline the usage of dual-use RMM software such as MeshCentral, AnyDesk, TeamViewer, and ScreenConnect. Unauthorized or unapproved installation of these tools across internal assets should trigger immediate high-priority alerts within the Security Operations Center (SOC).
• Patch Management and Perimeter Hardening: Edge devices, particularly SSL-VPN gateways, firewalls, and routers, must be patched immediately against known vulnerabilities such as CVE-2024-21762. Regular vulnerability scanning of external perimeters is critical to closing windows of opportunity for initial access actors.
• Identity and Access Management (IAM): Enforce mandatory Multi-Factor Authentication (MFA) across all administrative portals, VPN connections, and internal service accounts. Regularly review and rotate SSH keys, database credentials, and service certificates.
• Database Access Auditing: Implement strict database activity monitoring (DAM) to detect unauthorized queries, bulk data staging, or anomalous access attempts targeting customer identity repositories like RADIUS and LDAP databases.
• Network Segmentation: Isolate critical subscriber databases and core infrastructure behind robust internal firewalls and zero-trust network architecture (ZTNA) principles to prevent lateral movement even if an initial endpoint is compromised.

As threat actors continue to refine their techniques, blending malicious payloads with trusted enterprise administrative software, proactive hunting, behavioral analysis, and uncompromising perimeter hygiene remain the most effective bulwarks for defending critical network infrastructure against sophisticated intrusions.