Hackers exploited critical vulnerabilities in Fortinet and F5 products to infiltrate the systems of Thailand's major broadband provider, 3BB. The attackers used advanced tools for persistence and lateral movement within the network.

  • Threat actors exploited multiple CVEs in Fortinet and F5 products.
  • The breach was discovered via an exposed directory containing nearly 300 malicious files.
  • Attackers targeted 3BB (Triple T Broadband), a major Thai ISP.
  • Advanced persistence was maintained using MeshCentral and custom backdoors.

A sophisticated cyberattack has successfully breached the systems of 3BB (Triple T Broadband), one of Thailand's largest fixed-line broadband providers. According to a report by Hunt.io, the threat actors utilized a combination of vulnerabilities in Fortinet and F5 networking products to gain unauthorized access to the provider's infrastructure.

The intrusion came to light after investigators discovered an open directory hosted on Thai infrastructure. This directory served as a staging ground, containing 298 files organized into 30 subdirectories. These files included exploitation scripts, brute-force utilities, credential harvesting tools, and a MeshCentral instance configured as a persistent backdoor.

Read Also:The 'ORKS' Proposal: An Open Standard for Self-Destructing API Keys

Technical Breakdown of the Attack

The attackers began by fingerprinting a FortiGate SSL-VPN endpoint. Using a suite of eight specialized shell scripts, they identified the firmware version and probed for specific vulnerabilities. The attackers successfully deployed an exploit for CVE-2024-21762 to achieve Remote Code Execution (RCE).

The attackers demonstrated high operational maturity by tagging files into categories like 'Exploit' and 'Victim' within their staging environment.

Simultaneously, the threat actor conducted reconnaissance against the victim's F5 BIG-IP instance, probing for vulnerabilities such as CVE-2021-22986 and CVE-2023-46747. Once initial access was established, the actors attempted to escalate privileges on Linux systems using well-known exploits like PwnKit and Dirty COW.

Why This Matters

BozokMedia analysis shows that this attack highlights the growing danger of targeting critical telecommunications infrastructure. By compromising a provider like 3BB, which serves millions, attackers gain a strategic foothold that can lead to massive data exfiltration and widespread service disruption.

Following the compromise, the attackers moved laterally through the 3BB environment, attempting to extract sensitive data including SSH keys, database credentials, and Radius authentication data. To ensure they wouldn't be easily evicted, they implemented a meticulous cleanup process designed to erase logs and exploitation artifacts while keeping their hidden backdoors operational.

Did You Know?: Advanced persistent threats (APTs) often use 'cleanup scripts' to delete their tracks while simultaneously verifying that their secret access remains active.

Frequently Asked Questions

1. What specific vulnerabilities were exploited?
The attackers used several CVEs, most notably CVE-2024-21762 in Fortinet products and various F5 BIG-IP vulnerabilities.

2. How did the attackers maintain access to the system?
They established persistence using MeshCentral as a command-and-control platform and deployed custom SUID backdoors.