Threat actors exploited the critical FortiGate SSL-VPN vulnerability tracked as CVE-2024-21762 to access infrastructure linked to Thai broadband provider 3BB.
The attackers then deployed MeshCentral remote-management agents for persistent access, targeted RADIUS databases, and prepared scripts to erase evidence while retaining control of compromised systems.
Hunt.io discovered the operation after identifying an exposed directory hosted on a Thailand-based server at 92.63.180[.]133:8888.
Hackers Exploit FortiGate SSL-VPN Flaw
First observed on June 3, 2026, the directory reportedly contained 298 files across 30 subdirectories, including exploit code, credential-harvesting utilities, VPN configurations, web-session cookies, remote-access tooling, and a MeshCentral inventory of enrolled devices.
The exposed toolkit shows attackers conducting systematic reconnaissance against a FortiGate 60F SSL-VPN appliance at mail.3bb.co[.]th:10443.
Scripts fingerprinted the device, identified its FortiOS build, validated exposure to several known FortiGate flaws, and tested VPN credentials.
The threat actor ultimately focused on CVE-2024-21762, a FortiOS SSL-VPN out-of-bounds write vulnerability that can enable unauthenticated remote code execution on affected systems.
Recovered scripts suggest the attackers used staged checks to validate the issue, including controlled service-crash testing and incomplete HTTP request techniques intended to distinguish vulnerable appliances from patched ones.
After confirming the target’s vulnerability, the attackers allegedly used an exploit chain to establish a reverse shell to 92.63.180[.]133 on port 9443.
The directory also contained scripts intended to obtain FortiOS firmware images, apparently to tailor return-oriented programming payloads to the target’s FortiGate model and firmware version.
Following initial access, the attackers deployed MeshCentral, a legitimate open-source remote-management platform repurposed here as a command-and-control channel.
The recovered meshagent.msh configuration referenced a device group named TH-3BB and connected to www.ayuthayatech[.]com using the /agent.ashx WebSocket endpoint.
A devices.json export indicated that multiple devices had been enrolled in the MeshCentral environment. Several systems were reportedly active when the inventory was generated, with agents running with root privileges.
The operation also included installation scripts and fallback deployment methods, suggesting the attackers intended to retain access even if one persistence route failed.
The attackers’ apparent objectives extended beyond the VPN perimeter. Scripts targeted internal 10.11.x.x network ranges, SSH services, FTP servers, MySQL instances, and an internal Pentaho/Tomcat server.
The tooling also included credential-harvesting routines designed to collect SSH keys, PHP configuration files, database passwords, shell history, and SNMP community strings.
Of particular concern, database-dumping scripts targeted the radius_corp, radiusinfo, and job_radius databases. These systems may contain subscriber authentication data and network-device information, making them high-value targets for broader access or customer-account abuse.
The actor also possessed an OpenVPN configuration tied to the Jasmine and Triple T Broadband environment, alongside session artifacts connected to Jasmine-branded systems.
This suggests potential parallel activity against related infrastructure, although the available evidence does not independently confirm the full scope of compromise.
A cleanup script removed logs, exploitation files, web shells, and shell histories while preserving the MeshCentral agent and a hidden SUID backdoor.
Organizations should immediately patch affected FortiGate appliances, audit VPN authentication logs, investigate unauthorized MeshCentral deployments, rotate privileged credentials and certificates, and preserve forensic evidence before remediation.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
