Thai Broadband Provider 3BB Targeted in Sophisticated Breach Using Legitimate Remote Management Software
In a sophisticated cyber espionage operation, a threat actor successfully infiltrated the internal network of 3BB, one of Thailand’s largest broadband service providers, by weaponizing legitimate administrative tools to maintain long-term persistence. The intrusion, identified by threat intelligence firm Hunt.io, highlights a growing trend in the cybersecurity landscape where attackers eschew custom-built malware in favor of "living off the land" (LotL) techniques—abusing trusted software to bypass traditional security perimeters.
The discovery occurred when researchers stumbled upon an exposed server left accessible on the public internet by the attackers. This server, which served as a central command hub for the breach, contained a comprehensive repository of the attacker’s operational tools, a list of compromised internal machines, and evidence of administrative-level access within 3BB’s corporate infrastructure.
The Anatomy of the Intrusion
The breach was not a fleeting incident but a sustained campaign designed for data exfiltration and deep network reconnaissance. According to the data recovered by Hunt.io on June 3, 2026, the attackers had established a foothold that granted them "root" or administrative control over critical internal servers.
To ensure they could maintain access even if their initial entry vectors were patched or identified, the threat actors deployed MeshCentral. MeshCentral is a legitimate, open-source remote monitoring and management (RMM) platform commonly used by IT departments to perform routine maintenance, troubleshoot software issues, and manage large fleets of devices remotely. By installing MeshCentral agents on the internal 3BB machines, the attackers effectively turned a standard management tool into a hidden backdoor.
The configuration files recovered from the command-and-control (C2) server revealed that the agents were reporting back to a malicious domain, ayuthayatech[.]com, organized under a specific device group titled "TH-3BB." This deliberate organizational structure suggests that the attackers were managing multiple concurrent intrusions, likely tracking their progress across different sectors of the Thai telecommunications industry.
A Chronology of the Operation
While the exact date of the initial breach remains unconfirmed, the timeline reconstructed by investigators points to a high level of technical preparation.
- Pre-Infiltration Phase: The attacker’s toolkit included specific, highly developed scripts targeting FortiGate SSL-VPN gateways. Specifically, they possessed a working exploit for CVE-2024-21762, a critical vulnerability in Fortinet’s firmware that allows for remote code execution.
- The June 3 Discovery: Researchers at Hunt.io identified the open server. At the time of discovery, the operation was live. The server contained active lists of compromised machines, several of which were confirmed to be running with root privileges.
- Post-Discovery Cleanup: Following the detection of their staging server, the attackers initiated a cleanup script. This script was designed to systematically erase logs, delete secondary tools, and scrub evidence of the intrusion, while carefully preserving the MeshCentral backdoor to ensure they did not lose their access point.
- Current Status: As of the latest intelligence reports, the exposed directory has been closed by the threat actor. However, due to the nature of the persistence mechanisms installed—such as the hidden MeshCentral agents—it remains unclear whether the unauthorized access to 3BB’s internal network has been fully eradicated.
Tactical Methodology and Lateral Movement
The attackers demonstrated a methodical approach to lateral movement, indicating a high level of familiarity with telecommunications network architecture. Once inside, they did not immediately trigger alarms by mass-exfiltrating data. Instead, they focused on internal discovery.
Scripts recovered from the command server showed the attackers performing password spraying—a technique used to test common passwords against a large list of accounts—across at least 55 internal computers via SSH. Furthermore, the threat actors probed the internal sales portal (agent.3bb.co[.]th) and conducted automated searches of the compromised environment for sensitive artifacts, including stored database credentials and SSH keys.
The primary objective appeared to be the acquisition of RADIUS (Remote Authentication Dial-In User Service) database records. RADIUS is the backbone of most broadband authentication systems; gaining access to these databases would have provided the attackers with the login credentials for a significant portion of 3BB’s subscriber base. While the evidence confirms that the databases were actively targeted, Hunt.io did not find definitive proof that the data was successfully exfiltrated before the researchers intervened.
Cross-Network Implications
The scope of the breach extended beyond 3BB. The recovered server contained a valid VPN certificate belonging to 3BB, alongside active login sessions for services within the Jasmine network. Jasmine, a major telecommunications conglomerate and the former parent company of 3BB, still shares critical infrastructure and administrative interconnections with the broadband provider.
This discovery suggests that the attackers were not solely interested in 3BB, but were potentially using it as a gateway to pivot into the broader Jasmine ecosystem. This "supply chain" style of compromise—where one company is used to reach a larger, more sensitive target—is a hallmark of advanced persistent threat (APT) groups.
The Growing Threat of "LotL" Attacks
The 3BB incident serves as a textbook example of the "living off the land" (LotL) phenomenon. Because MeshCentral is a digitally signed, benign application, standard signature-based antivirus solutions often fail to flag it as malicious. When an IT administrator sees MeshCentral running on a server, they assume it is part of their own standard operations.
This creates a significant blind spot for network defenders. The challenge is no longer just identifying malicious software, but identifying malicious behavior—detecting when a legitimate tool is being used by an unauthorized entity. Security professionals are now being urged to implement strict "allow-listing" for remote management tools and to monitor for anomalies such as MeshCentral agents connecting to unknown or unauthorized external IP addresses.
Official Responses and Industry Outlook
In accordance with responsible disclosure practices, Hunt.io notified both 3BB and the relevant national cybersecurity authorities in Thailand prior to the public release of their findings. While 3BB has not issued a detailed public statement regarding the extent of the breach or the steps taken to remediate the vulnerability, the industry response has been one of heightened vigilance.
The use of CVE-2024-21762 as a centerpiece in the attacker’s toolkit underscores the critical importance of timely patch management. While there is no definitive proof that the exploit was the specific vector used to gain entry, its presence indicates that the attackers were actively scanning for and exploiting vulnerabilities in edge devices like the FortiGate SSL-VPN gateway.
Recommendations for Defenders
For organizations operating in the telecommunications and critical infrastructure sectors, the Hunt.io report provides a roadmap for mitigation. Defenders are advised to:
- Harden Edge Devices: Ensure that all VPN gateways, firewalls, and public-facing portals are patched against known vulnerabilities (CVE-2024-21762).
- Audit RMM Tools: Perform a comprehensive audit of all remote management software currently in use. Identify authorized instances and cross-reference them with established IT policies.
- Monitor Outbound Traffic: Implement strict egress filtering. Any internal machine attempting to communicate with an unknown C2 server should trigger an immediate security alert, regardless of whether the software initiating the connection appears "trusted."
- Credential Hygiene: Given the attackers’ focus on SSH keys and stored database passwords, organizations should prioritize the use of multi-factor authentication (MFA) for all internal administrative access and rotate credentials regularly.
The 3BB breach remains a stark reminder that in the modern digital age, the most dangerous threats often masquerade as the most helpful tools. As threat actors continue to refine their ability to hide in plain sight, the reliance on automated security software must be balanced by rigorous, manual threat hunting and proactive network architecture monitoring.
