3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials

An attacker gained access to the network of 3BB, a major Thai broadband provider, and used a legitimate management tool called MeshCentral to maintain remote control of internal machines. The attacker's goal was to obtain subscriber credentials. The intrusion was discovered by threat intelligence firm Hunt.io, which found a server the attacker had left open on the internet containing their own tools and a list of targeted information. This server was used by the attacker to maintain root access to 3BB's internal systems. The discovery was made after examining the openly accessible server. Hunt.io was able to uncover the details of the intrusion through this examination.