Actor Profile

The threat actor behind this intrusion remains unattributed. The operation targeted 3BB, Thailand's largest broadband provider, with the apparent objective of exfiltrating subscriber credential databases. The attacker demonstrated sophisticated tradecraft, including use of legitimate remote management tools for persistence, custom scripting for credential harvesting, and operational security measures such as log-wiping scripts. Motivation appears to be intelligence collection or preparation for subsequent attacks leveraging stolen ISP credentials. The actor maintained active administrative control over multiple internal systems as of June 2026, with evidence suggesting parallel targeting of Jasmine network infrastructure through shared VPN certificates and active login sessions.

TTPs (Tactics, Techniques, Procedures)

Initial access likely achieved via exploitation of CVE-2024-21762 (Fortinet SSL-VPN pre-authentication RCE) targeting mail.3bb.co[.]th, though not definitively confirmed. Persistence established through MeshCentral remote management agents configured as hidden backdoors (T1219: Remote Access Software), SUID files, web shells (T1505.003), and SSH key injection (T1098.004). Credential access pursued via password spraying over SSH against 55+ internal hosts (T1110.003), harvesting stored passwords and database credentials (T1552.001), and targeting RADIUS authentication databases. Lateral movement conducted through SSH with compromised credentials (T1021.004). Defense evasion implemented via custom cleanup scripts designed to erase logs and delete tools while preserving MeshCentral agents (T1070.001, T1070.004). Command and control maintained through MeshCentral infrastructure at www.ayuthayatech[.]com under device group TH-3BB. Collection focused on RADIUS subscriber databases and internal portal access at agent.3bb.co[.]th.

Targets & Patterns

The campaign specifically targeted telecommunications and internet service provider infrastructure in Thailand, focusing on 3BB (Triple T Broadband) and potentially Jasmine International, with whom 3BB shares legacy infrastructure. The attacker prioritized access to subscriber authentication systems, specifically RADIUS databases containing customer login credentials used for broadband authentication. This targeting pattern suggests either intelligence collection objectives (mass surveillance capability through ISP credential access), preparation for supply-chain attacks against 3BB customers, or monetization through credential sales. The presence of valid VPN certificates and active Jasmine network sessions indicates the attacker exploited shared infrastructure relationships between merged or partnered telecommunications entities. Edge devices (FortiGate SSL-VPN gateways) and internal sales portals were secondary targets used to establish and expand access.

Historical Context

This intrusion follows an established pattern of threat actors targeting telecommunications providers to access subscriber data and authentication infrastructure. The abuse of MeshCentral and similar legitimate remote management tools (TeamViewer, AnyDesk, ConnectWise) as post-compromise backdoors has been increasingly documented across multiple threat actor groups since 2023. The exploitation of Fortinet SSL-VPN vulnerabilities, particularly CVE-2024-21762 disclosed in February 2024, aligns with widespread targeting observed by multiple security vendors throughout 2024-2026. The intrusion was discovered through exposed attacker infrastructure on June 3, 2026, representing a significant operational security failure by the threat actor. No direct linkage to previously documented campaigns or named threat actor groups is established in the available evidence.

Defensive Recommendations

  • Immediately patch FortiGate SSL-VPN appliances against CVE-2024-21762 or disable SSL-VPN functionality entirely if patching is not possible, as disabling web mode alone is insufficient mitigation per Fortinet advisory
  • Hunt for unauthorized MeshCentral, TeamViewer, AnyDesk, or similar remote management agents (T1219) by auditing installed software and monitoring for connections to unrecognized external management servers, particularly checking persistence paths like /usr/local/bin/.rc and /usr/local/mesh_services/
  • Implement detection for SSH password spraying (T1110.003) through monitoring of failed authentication attempts across multiple hosts from single sources, and credential harvesting activity (T1552.001) targeting configuration files, databases, and SSH key directories
  • Rotate all potentially exposed credentials including SSH keys, RADIUS database passwords, VPN certificates, and application secrets, as patching does not remediate already-compromised authentication material
  • Search for persistence mechanisms including unexpected SUID files, web shells in web server directories (T1505.003), modified authorized_keys files (T1098.004), and newly added remote management software, while preserving logs before cleanup as attacker scripts specifically target log deletion (T1070.001)

---

# Geopolitical Context

Geopolitical Context

The intrusion into 3BB, Thailand's largest broadband provider, represents a significant compromise of critical telecommunications infrastructure in Southeast Asia. Telecommunications providers are high-value targets due to their role in national communications infrastructure and their repositories of subscriber data, including authentication credentials for millions of users. The attacker's use of legitimate remote management tools (MeshCentral) and focus on RADIUS databases—which store customer login credentials—suggests operational sophistication consistent with either financially-motivated cybercrime or intelligence collection. The potential lateral movement into Jasmine network infrastructure, with which 3BB shares systems, indicates the breach may have affected a broader segment of Thailand's telecommunications sector. Thailand's position as a regional digital hub and its growing role in ASEAN connectivity makes such compromises strategically significant, though no state-actor attribution has been established in this case.

State Actor Alignment

No attribution to state actors has been made in available reporting. The intrusion's characteristics—credential harvesting, persistent backdoor installation, and targeting of subscriber authentication databases—are consistent with both advanced persistent threat (APT) operations and organized cybercrime. The attacker's toolkit included an exploit for CVE-2024-21762, a critical Fortinet SSL-VPN vulnerability, though it remains unconfirmed whether this was the initial access vector. The operational security lapse (exposed server at 92.63.180[.]133) and the focus on subscriber credentials may suggest financially-motivated actors, though intelligence services have also targeted telecommunications providers for lawful intercept capabilities and metadata collection. Without further technical indicators or geolocation of command infrastructure beyond the exposed server, state sponsorship cannot be assessed.

Business Impacty pro region

The breach has implications for Thailand's digital sovereignty and the security of Southeast Asian telecommunications infrastructure. If subscriber RADIUS credentials were exfiltrated, millions of Thai broadband users could face account compromise, surveillance, or man-in-the-middle attacks. The potential compromise of shared infrastructure with Jasmine network suggests cascading risk across interconnected providers. For the ASEAN region, this incident underscores vulnerabilities in telecommunications sectors that are critical to the bloc's digital economy ambitions and smart city initiatives. European and allied telecommunications operators should note the attacker's abuse of MeshCentral, a legitimate IT management tool, as part of a broader trend of "living off the land" techniques that evade traditional security controls. The incident also highlights supply chain and shared infrastructure risks in telecommunications, where business relationships create pathways for lateral movement across organizational boundaries.

Forecast

If the attacker retained access beyond the June 2026 discovery window, further credential harvesting and potential data exfiltration are likely, particularly if remediation was incomplete. If RADIUS database credentials were successfully exfiltrated, secondary compromises of subscriber accounts may emerge in coming months, potentially manifesting as account takeovers or fraud. If the intrusion was state-sponsored rather than criminal, the access may be preserved covertly for long-term intelligence collection rather than immediate exploitation. Organizations operating Fortinet SSL-VPN appliances, particularly in Southeast Asia, should expect continued targeting via CVE-2024-21762 and similar edge device vulnerabilities. If the attacker's operational security lapse (exposed server) reflects broader tradecraft weaknesses, additional victims using similar infrastructure may be identified through threat hunting. Regional telecommunications providers should anticipate increased scrutiny from national cybersecurity authorities and potential regulatory pressure to demonstrate infrastructure resilience.