MeshCentral Root Access Aimed at Thai Broadband Logins: 3BB Says the Servers Belonged to a Corporate Client

อ่านภาษาไทย

An Open Directory, a MeshCentral Backdoor and RADIUS Databases

On 14 September 2026, threat-intelligence firm Hunt.io published a technical report on an active intrusion tied to Thai broadband infrastructure. Researchers had captured an attacker-controlled server left open on the internet on 3 June 2026. Inside were about 298 files: exploit scripts, password-spray tools, a MeshCentral agent configuration, and a device inventory of machines already under the attacker's control. The Hacker News summarised the same findings the same day.

According to Hunt.io, MeshCentral — a legitimate remote-management tool that IT teams use every day — had been installed as a hidden backdoor. Agents reported to a server the attacker ran at www.ayuthayatech.com, under a device group named TH-3BB. Several enrolled machines were connected with root privileges when the inventory was exported. A cleanup script was written to wipe logs and delete other tools while deliberately leaving the MeshCentral agent in place.

The scripts also targeted RADIUS databases named radius_corp, radiusinfo and job_radius — the kind of systems that store the login credentials broadband customers use to get online. Hunt.io is clear on one point that matters for every compliance team: the evidence shows those databases were targeted, not that any subscriber data was confirmed stolen.

What 3BB Said Two Days Later

On 16 September 2026, 3BB issued a public clarification, reported by Telecomlover and other Thai tech outlets. The company said its internal checks found no unauthorised access to 3BB customer data. It said the incident involved an attempted breach of an enterprise client's own system — systems the client manages, not systems operated by 3BB — that it had notified that client to inspect and harden its security, and that it had briefed the National Cyber Security Agency (NCSA / สกมช.) and relevant regulators.

So the public record, as it stands, is this: researchers described MeshCentral root access and RADIUS-dump tooling inside infrastructure they tied to 3BB branding and internal domains; 3BB attributes the hit to a corporate customer's self-managed environment and says no 3BB customer data was accessed. Either way, the lesson for Thai companies is the same.

What This Means for Your Company

• Corporate-managed servers are the soft target. If 3BB's account is right, the attacker was after an enterprise client's own stack. Colo racks, on-prem RADIUS or AAA servers, VPN gateways, and "temporary" Linux boxes that never left the storeroom all look like that. They hold staff SSH keys, database passwords and customer logins long after the project that justified them is over.
• Legitimate admin tools become invisible backdoors. MeshCentral, remote-support agents and similar software blend into normal IT traffic. Once an agent is running as root, rotating a firewall password is not enough. You also have to find and remove the agent, and then decide what to do with the machine that hosted it.
• Credential databases outlive the business case. RADIUS, LDAP and local MySQL copies of user tables are exactly the kind of data PDPA expects you to erase when retention ends. A server that still holds them is a breach waiting for the next open directory.
• Entry method may stay unconfirmed; the cleanup cannot. Hunt.io recovered a full toolkit for FortiGate CVE-2024-21762 against a 3BB-branded SSL-VPN, but does not prove that exploit was the way in. Waiting for a perfect root-cause report is a bad reason to leave old disks and spare servers sitting in a cupboard.

A Practical Clean-Up After Any Intrusion Scare

1. Inventory every server, NAS and colo box your company actually owns or manages — including ones hosted at an ISP or data centre under your own admin rights.
2. Hunt for unexpected remote-management agents, hidden SUID binaries, web shells and SSH keys you did not install. Rotate RADIUS, database, VPN and application credentials that may have been copied.
3. When a machine is replaced or no longer trusted, do not wipe-and-store it "just in case". Book documented server data destruction with serial numbers logged and a certificate for each unit.
4. Send loose and spare disks for hard drive and SSD destruction, treat staff laptops that held VPN configs or exported credential files through laptop data destruction, and fold a full refresh into one IT asset disposal project with certificates filed against your PDPA records.

For server jobs we collect from your Bangkok office, log serial numbers on collection, keep a full chain of custody through physical destruction, and issue a Certificate of Data Destruction for each server (serial number, method and date) plus an inventory report. Photo and video evidence is available. We handle devices only; we do not shred paper.

Get an instant quote or call 082-797-3702 to destroy the servers and drives that still hold RADIUS dumps, SSH keys and old customer logins, so the next MeshCentral-style backdoor has nothing useful left to find.

Sources: Hunt.io, "Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence" (14 Sep 2026); The Hacker News, "3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials" (14 Sep 2026); Telecomlover, "3BB Confirms No Customer Data Accessed, Clarifies Incident Involved Enterprise Client System" (16 Sep 2026); Monster Connect summary of the AIS/3BB clarification (Sep 2026).