Attackers Expose Full Toolkit: 3BB Breach via FortiGate CVE-2024-21762

On June 3, 2026, Hunt.io researchers discovered an open directory on a threat actor staging server that, according to the cited source, had compromised Triple T Broadband (3BB), one of Thailand's largest fixed-line broadband providers. The accidental exposure revealed 298 files across 30 subdirectories totaling 19 megabytes: a complete operational toolkit documenting every phase of the kill chain, from initial access to persistence.

The incident confirms that edge VPN appliances remain a critical vector for telecommunications operators. The source reported no official statements from 3BB or its parent company ThaiBev, nor has any regulatory disclosure of the breach emerged.

The Entry Chain: From CVE-2024-21762 to Appliance Control

The attack targeted a FortiGate 60F appliance exposed at mail.3bb.co[.]th:10443, according to the cited source. The vulnerability CVE-2024-21762, an out-of-bounds write in the FortiOS and FortiProxy SSL-VPN component, carries a CVSS 9.8 score in the NVD with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is not a zero-day: it has been in the KEV catalog since February 2024.

Attackers used eight scripts named forti1.sh through forti8.sh for a structured sequence: appliance fingerprinting, probing of historical vulnerabilities (CVE-2018-13379 CVSS 9.1, CVE-2022-42475 CVSS 9.8, CVE-2023-27997 CVSS 9.8), and finally the specific exploit for CVE-2024-21762. The exploit employed heap spraying and a ROP chain to achieve remote code execution, spawning a Node.js reverse shell to 92.63.180[.]133 on port 9443.

A notable operational detail: the scripts contained the target appliance's serial number FGT60FTK2209FY0V, used to impersonate the device in an attempt to download the specific FortiOS 7.2.5 firmware. The source does not specify whether the firmware was actually downloaded or the request completed.

MeshCentral as Abused RMM: Persistence and Command-and-Control

After initial compromise, attackers established persistent access by deploying MeshCentral, a legitimate remote monitoring and management platform, as a backdoor. According to the cited source, the meshagent.msh configuration file shows a device group named 'TH-3BB' and a C2 server at www.ayuthayatech[.]com. The devices.json file lists active systems with root-level privileges, indicating the platform managed full administrative access.

The use of legitimate RMM tools is an established TTP: it reduces detection risk from endpoint security tools that often exclude remote administration software processes from profiling. The choice of MeshCentral, open-source and self-hostable, allowed attackers to maintain control without relying on traceable commercial infrastructure.

"After successful host compromise, the actor established persistent remote access using MeshCentral as a command-and-control (C&C) platform for remote administration"

The Operational Error: 298 Files in Open Directory Reveal Full Arsenal

On June 3, 2026, Hunt.io researchers captured the contents of an open directory on server 92.63.180[.]133:8888. The collection comprised 298 files distributed across 30 subdirectories totaling 19 megabytes. According to the cited source, files were organized by operational categories: Exploit, Victim, Config, and History.

Exposed materials included privilege escalation scripts leveraging PwnKit and Dirty COW, a hidden SUID backdoor installed at /usr/local/bin/.rc, credential harvesting tools for SSH keys, PHP configurations, database credentials, SNMP community strings, and RADIUS data. References to the internal 10.11.x.x IP range and 55+ addresses in SSH password-spraying scripts indicated extensive reconnaissance inside the 3BB network.

Particularly significant was the jasmine.ovpn file, containing a PKI certificate and private key issued in the name of Triple T Broadband. The dossier does not specify whether the certificate has been revoked or still provides valid access to the ISP's VPN network. The role of "Jasmine" in the current infrastructure is also unclear: the name could refer to a historical user, a legacy system, or a service account.

Selective Anti-Forensics: Erase Traces, Preserve Access

The toolkit included a script named cleanup_target.sh designed for selective anti-forensic operations. According to the cited source, the script removed system logs, web shells, and other compromise artifacts, but concluded by explicitly verifying that persistence mechanisms remained operational: it checked for the hidden SUID binary at /usr/local/bin/.rc and confirmed the MeshCentral service was still running.

"The script concludes by verifying that persistence mechanisms remain operational, including checking the hidden SUID binary and confirming the MeshCentral service is still running"

This pattern reveals a structured operation with compartmentalization: the cleanup phase is instrumental to access survival, not its elimination. The sophistication suggests operators familiar with incident response practices and forensic defenders' focus areas.

Reconnaissance Beyond Fortinet: F5 BIG-IP in the Crosshairs

Beyond Fortinet infrastructure, the toolkit contained eleven scripts targeting portal agent.3bb.co[.]th for probing vulnerabilities in F5 BIG-IP appliances: CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747. This expansion of the attack surface indicates operators did not limit themselves to the initial vector but actively mapped VPN and remote access technologies present in the ISP's perimeter.

The source does not specify whether these F5 systems were actually compromised or if probing yielded positive results. The data remains an indicator of intent and prior knowledge of the target architecture.

Immediate Actions

• Verify that FortiGate appliances exposed on SSL-VPN run FortiOS versions that patch CVE-2024-21762, given functional in-the-wild exploits with model-specific ROP chains.
• Scan the network for connections to domains and IPs listed in the evidence map: 92.63.180[.]133 (staging and C2), www.ayuthayatech[.]com (MeshCentral C2).
• Review active MeshCentral processes in infrastructure: the 'TH-3BB' group name is a specific indicator, but any unauthorized RMM instance warrants investigation.
• Check for SUID binaries in non-standard paths, particularly /usr/local/bin/.rc, and validate persistence mechanism integrity via launchctl or systemd.

An Involuntary TTP Sample: Why Exposure Changes the Game for Defenders

The Hunt.io discovery represents an exception in contemporary threat intelligence. Sophisticated operators rarely expose their full operational toolkit: complete visibility into exploits, configurations, credentials, and cleanup logic allows defenders to reconstruct the kill chain without inference, verifying every phase with concrete indicators.

For the telecommunications sector, the incident confirms that edge VPN appliances remain a structural weak point: even operators with millions of users can host inadequately patched appliances exposed to the internet. For defenders, the 298-file collection offers a rare benchmark for comparison with other intrusions and for refining controls on abused RMM and selective anti-forensic techniques.

The disclosure posture remains open: without official confirmation from 3BB or Thai authorities, the actual impact on the provider's millions of users cannot be quantified based on the available dossier.

Information verified against cited sources and current as of publication.

Sources

• https://www.securityweek.com/thai-broadband-provider-hacked-via-fortinet-vulnerability/
• https://www.cryptika.com/hackers-exploit-fortigate-ssl-vpn-vulnerability-to-attack-broadband-provider/
• https://gbhackers.com/hackers-exploit-fortigate-ssl-vpn-flaw/
• https://thehackernews.com/2026/06/attackers-exploit-three-fortinet.html
• https://podcast.securityweek.com/