3BB Attacker Used Mesh Central Backdoor for Root Access, Targeted Subscriber Credentials
Summary: Hunt.io researchers captured an exposed server on June 3, 2026 that an attacker had used to run tools from inside 3BB's network, including a file showing root access to an internal server. The attacker installed MeshCentral as a hidden backdoor reporting to www.ayuthayatech[.]com under a device group named TH-3BB, and recovered scripts sprayed passwords against more than 55 internal computers over SSH and were built to copy out 3BB's RADIUS databases.
Key Takeaway: The attacker's main goal was the RADIUS databases holding broadband subscriber login credentials, and the same server carried a valid 3BB VPN certificate plus active sessions on the Jasmine network - so the exposure may extend past one provider's perimeter.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Mentions
- CVE-2024-21762
- Related
- CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability Known Exploited Vulnerabilities · Feb 09, 2024Storm Watch | Cyber Insights | VMware Vulnerabilities, Microsoft's Russia Breach, and USB Hacks by Nation States Cyber Risks ·Hunting for Fortinet's CVE-2024-21762 | Grey Noise Blog Cyber Risks ·