Hackers Target Broadband Provider Through FortiGate VPN Flaw

Security researchers have uncovered a large-scale intrusion targeting 3BB, the consumer broadband brand of Thailand’s Triple T Broadband.

The investigation began after researchers discovered an exposed server containing tools, credentials, configuration files, and other material linked to the attack. The evidence suggests the attackers gained an initial foothold through a vulnerable FortiGate SSL-VPN appliance and then moved deeper into the provider’s environment.

The campaign appears to have involved several stages, including:

Exploiting a vulnerable VPN device
Gaining higher privileges on Linux systems
Searching for credentials and private keys
Scanning internal systems
Moving between servers
Deploying persistent remote-access software
Removing evidence of the intrusion

FortiGate Flaw Used as the Entry Point

Hunt.io identified an exposed staging server at 92.63.180[.]133:8888 on June 3, 2026. The server contained nearly 300 files and multiple directories with tools apparently prepared for different stages of the operation.

Several files pointed directly toward 3BB infrastructure, including internal IP addresses, company domains, credentials, VPN configurations, and captured session information.

The attackers appear to have focused on CVE-2024-21762, a critical FortiOS SSL-VPN vulnerability that can allow remote code execution without authentication. The flaw has a CVSS score of 9.8 and was previously added to CISA’s Known Exploited Vulnerabilities catalog.

Recovered scripts showed reconnaissance against the FortiGate SSL-VPN service before exploitation. The attackers also appeared to test the device before using a more advanced exploit chain to establish a reverse connection back to their infrastructure.

After gaining access, they installed MeshCentral, a legitimate remote-management platform, and configured it to provide continued access to compromised systems.

The investigation also uncovered signs that the attackers attempted to move beyond the VPN device:

Linux privilege-escalation tools were prepared.
SSH credentials and private keys were searched for.
Database passwords and application configuration files were targeted.
Internal systems were scanned for additional weaknesses.
RADIUS databases were targeted for authentication information.
An OpenVPN profile containing a certificate and private key was discovered.
A concealed SUID-based backdoor was prepared for Linux systems.

Persistent Access and Anti-Forensics

The attackers did not appear to rely only on the original VPN compromise. MeshCentral agents were found associated with a device group named TH-3BB, with some agents reportedly operating with root privileges.

The toolkit also contained scripts designed to check security software and automate the installation of the remote-management agent.

More concerningly, the attackers attempted to clean up traces of their activity. A cleanup script was designed to remove exploitation files, web shells, authentication records, system logs, and shell histories while leaving the MeshCentral service in place.

Researchers also found reconnaissance activity against an internal sales portal behind an F5 BIG-IP appliance. The testing covered areas such as authentication, file uploads, SQL injection, path traversal, and other application weaknesses.

Organizations using potentially affected FortiOS versions should treat this type of activity as a potential compromise rather than simply a patching issue.

Recommended actions include:

Upgrade FortiGate devices to a supported fixed release.
Disable SSL-VPN if immediate patching is not possible.
Look for unexpected MeshCentral installations or agents.
Investigate connections involving 92.63.180[.]133 and the identified external domain.
Check for unusual SUID files, web shells, and modified SSH authorization files.
Rotate VPN certificates, SSH keys, database credentials, RADIUS secrets, and privileged passwords.
Preserve forensic evidence before removing suspicious files or systems.
Review security logs for unexplained gaps or signs of log deletion.

The incident highlights how a vulnerable internet-facing VPN appliance can become the starting point for a much broader compromise. Once attackers gain access, they may use stolen credentials, privilege escalation, internal reconnaissance, and legitimate remote-management tools to maintain control and move through the network.