As reported by The Hacker News, threat intelligence firm Hunt.io uncovered a sustained intrusion inside 3BB, one of Thailand's largest broadband providers, where an attacker maintained root-level control of internal machines using MeshCentral — a legitimate open-source remote management tool — repurposed as a stealthy backdoor. The operation was discovered only because the attacker left their own command-and-control server exposed on the internet.

Threat Intelligence: As reported by The Hacker News, threat intelligence firm Hunt.io uncovered a sustained intrusion inside 3BB, one of Thailand's largest broadband providers, where an attacker maintained root-level control of internal machines using MeshCentral — a legitimate open-source remote management tool — repurposed as a stealthy backdoor.

Why This Matters

This incident is a textbook example of the living-off-the-land (LotL) problem reaching critical infrastructure. MeshCentral, like AnyDesk, TeamViewer, ScreenConnect, and similar tools, is designed for legitimate IT administration. When an attacker installs it inside a target network, the traffic and processes look indistinguishable from normal operations. Traditional endpoint detection and network monitoring often flag these as benign — which is precisely why adversaries increasingly prefer them over custom malware.

What elevates this case beyond a standard breach is the target profile. The attacker's scripts were purpose-built to extract RADIUS databases — the authentication stores containing subscriber login credentials for broadband access. Compromising RADIUS at an ISP doesn't just expose customer data; it potentially enables session hijacking, credential reuse across services, and persistent surveillance of subscriber traffic. For a national broadband provider, this is a national-security-grade concern.

The attacker's cleanup script deliberately preserved the MeshCentral agent while wiping other artifacts — a clear signal that persistent, stealthy remote access was the priority, not one-time data exfiltration.

Broader Implications

Broader Implications
Telecom and ISP targeting is escalating. Subscriber credential repositories, RADIUS infrastructure, and internal portals are high-value targets for both criminal syndicates and state-sponsored actors seeking bulk access to civilian communications.
Shared infrastructure multiplies blast radius. The recovered VPN certificate and Jasmine network sessions suggest the attacker was probing interconnected systems between 3BB and Jasmine — a reminder that mergers, acquisitions, and legacy infrastructure sharing create persistent trust boundaries that attackers exploit.
Exposed attacker infrastructure is a double-edged sword. Hunt.io's discovery was serendipitous. Most attackers don't leave their C2 servers open. Defenders cannot rely on this kind of luck — proactive threat hunting is essential.

Who Is at Risk

Any organization that permits or fails to monitor remote management tools on internal systems is exposed. ISPs, managed service providers, and enterprises with large internal Linux estates are particularly vulnerable. The 3BB attacker used SSH password spraying across 55+ internal machines — a technique that succeeds only when SSH access is broadly permitted and credential hygiene is inconsistent.

Shield53 Recommendations

  • Inventory and audit all remote management tools. Deploy endpoint tooling that flags any installation of MeshCentral, AnyDesk, ScreenConnect, or similar software outside of an approved deployment pipeline. Any unmanaged instance should trigger an immediate investigation.
  • Monitor MeshCentral agent traffic patterns. Look for agents beaconing to non-corporate domains, unexpected device group names, or agents running with root/system privileges on servers that shouldn't have remote management enabled.
  • Harden SSH at scale. Disable password authentication entirely. Enforce key-based access with centralized key management. Implement fail2ban or equivalent rate-limiting. Monitor for distributed password spraying across multiple hosts from single sources.
  • Segment RADIUS and authentication infrastructure. RADIUS databases should sit on isolated network segments with strict access controls. Database credentials should never be stored on general-purpose servers where attackers can harvest them.
  • Hunt for living-off-the-land persistence. Regularly audit running processes, systemd services, and scheduled tasks for legitimate tools operating in unexpected contexts. Review outbound connections from server infrastructure to external endpoints on non-standard ports.
  • Review inter-organizational trust relationships. If your organization shares infrastructure, VPN certificates, or network access with former parent or subsidiary entities, map those trust paths and assume they are attacker pathways.

The 3BB case reinforces an uncomfortable truth: the most dangerous attackers aren't the ones with exotic zero-days. They're the ones who blend in so well that you only find them by accident — or by hunting aggressively before the accident happens.