Security researchers have identified an active exploit campaign targeting Triple T Broadband’s consumer brand 3BB in Thailand. Attackers leveraged a serious vulnerability in Fortinet’s FortiGate SSL-VPN appliance to penetrate the provider’s network, steal credentials, escalate privileges, and establish long-term access. An exposed server detailed much of the attackers’ toolkit and tactics.
How the Breach Unfolded
The operation came to light when analysts discovered an unprotected directory hosted on IP address 92.63.180[.]133:8888, traced back to Bangmod Enterprise infrastructure, on June 3, 2026. It contained 298 files across 30 subdirectories—roughly 19 MB of data. Among them were tools for exploiting FortiGate SSL-VPN, Linux privilege escalation, SSH brute-force attacks, scripts for grabbing database credentials, VPN configs, session cookies, cleanup scripts, and a configuration for the remote-management platform MeshCentral. Many artifacts pointed directly to 3BB’s internal network.
The attackers targeted a FortiGate 60F SSL-VPN device exposed via mail.3bb.co[.]th:10443, beginning with reconnaissance that included HTTP header inspection, service fingerprinting, and tests against known vulnerabilities. They zeroed in on CVE-2024-21762—a critical out-of-bounds write flaw in FortiOS and FortiProxy SSL-VPN, which can enable unauthenticated attackers to execute arbitrary code via malicious HTTP requests. With a CVSS score of 9.8, this vulnerability was added to CISA’s Known Exploited Vulnerabilities list in February 2024.
The attackers reportedly combined heap spraying with a return-oriented programming (ROP) method to trigger the vulnerability and open a reverse shell back to their server. To tailor the attack, they attempted to download FortiOS 7.2.5 firmware specific to the device model and even embedded the appliance’s serial number in requests mimicking components of Fortinet’s distribution infrastructure.
Post-Compromise Activity and Internal Reconnaissance
Once inside the network, the threat actors deployed MeshCentral as a persistent backdoor for remote management. Agents ran under root privileges and reported to the domain www.ayuthayatech[.]com. Scripts aimed to remove evidence by deleting logs and shell histories, but they preserved MeshCentral to maintain access.
The intruders didn’t stop at the VPN appliance. Eleven reconnaissance scripts targeted an internal sales portal under an F5 BIG-IP appliance, checking for weaknesses like SQL injection, session forgery, file upload flaws, server-side request forgery, path traversal, and HTTP request smuggling. On Linux servers, they prepared exploits including Dirty COW and PwnKit, and planted hidden SUID backdoors. Information seekers exfiltrated SSH keys, database credentials, RADIUS secrets, and more. OpenVPN certificates tied to 3BB’s Jasmine network were exposed; if still valid, they could grant access beyond just the VPN.
What to Do Now
Fortinet lists several versions of FortiOS and FortiProxy—spanning 6.4.x, 7.0.x, and 7.2.x—as vulnerable. Administrators are urged to update to a release that patches CVE-2024-21762. If patching isn’t immediately possible, the SSL-VPN feature should be disabled entirely. Disabling only the web mode is insufficient as a temporary mitigation.
Organizations potentially impacted should search their infrastructure for signs of compromise: look for unexpected MeshCentral agents, reverse-shell traffic back to 92.63.180[.]133, connections to www.ayuthayatech[.]com, hidden SUID files, web shells, unauthorized SSH changes, and suspicious gaps in logs. Replace exposed certificates, rotate credentials like passwords, secrets, keys, and preserve forensic evidence before cleaning up, because attackers made efforts to erase traces.
This breach underscores the risk posed by leaving SSL-VPN appliances exposed, especially when known critical vulnerabilities are left unpatched. It also reveals how attackers combine known flaws, credential theft, and anti-forensic techniques to gain deep, persistent access.
