Hackers broke into Thai broadband provider 3BB and left behind a toolkit showing how they probed and exploited its internet-facing security systems. Hunt.io says the attackers fingerprinted a FortiGate SSL-VPN appliance, checked for CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, and then used CVE-2024-21762 for remote code execution, while also probing F5 BIG-IP for CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747. The intrusion included MeshCentral persistence, Linux privilege-escalation attempts using PwnKit and Dirty COW, credential harvesting, SSH key theft, web shell deployment, and cleanup scripts to hide traces while preserving access.
Why it matters: This shows attackers actively chaining older and newer edge-device flaws to break into a major internet provider and move deeper into internal systems. Organizations running Fortinet or F5 products should urgently verify patch status, hunt for MeshCentral agents, web shells, rogue SSH keys, and credential theft, and review whether older known Fortinet bugs were ever fully remediated.
Ionut Arghire
2026.09.15
100% relevant
This article establishes a distinct intrusion at 3BB centered on exploitation of Fortinet and F5 edge infrastructure, not the same underlying event as any listed tracked story.
← Back to all stories