3BB Exposed MeshCentral Server Reveals Active Root Access and RADIUS Credential Targeting
An exposed attacker server showed ongoing MeshCentral backdoor use inside 3BB with root privileges and scripts focused on RADIUS credential theft. Initial access via the FortiGate exploit remains unproven despite complete tooling. The operation also touched shared Jasmine infrastructure.
The server, run from inside 3BB's network and pointing to ayuthayatech[.]com under group TH-3BB, listed multiple machines with active root sessions. A cleanup script deliberately preserved the MeshCentral agent while erasing other traces. Scripts also targeted agent.3bb.co[.]th and harvested SSH keys plus VPN sessions tied to the Jasmine infrastructure, indicating lateral movement beyond a single provider.
The toolkit included a full exploit chain for CVE-2024-21762 against mail.3bb.co[.]th yet contained no execution logs or successful output, leaving initial access unconfirmed. This pattern matches documented abuse of legitimate remote-management tools that blend with IT traffic, seen in prior campaigns against edge appliances where attribution relied on infrastructure reuse rather than claimed state links.
Official notification reached Thai authorities and the victims, but the exposed directory has since closed. Whether the MeshCentral agents remain active or subscriber data was exfiltrated cannot be determined from the June snapshot. Defenders must audit FortiGate SSL-VPN instances for the 2024 flaw and inventory any MeshCentral deployments outside approved management domains.
Hunt.io: No public confirmation of data exfiltration from 3BB RADIUS systems by 30 September 2026 if internal logs show no outbound transfers.
Sources (3)
- [1]Hunt.io Threat Report(https://hunt.io/reports/3bb-meshcentral-june2026)
- [2]Fortinet PSIRT CVE-2024-21762(https://www.fortinet.com/psirt/FG-IR-24-21762)
- [3]The Hacker News 3BB Coverage(https://thehackernews.com/2026/09/3bb-attacker-used-meshcentral-backdoor.html)