An attacker operated inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, according to threat intelligence firm Hunt.io. The intrusion was discovered after the attacker left a server open on the internet, which exposed the attacker's own tools and a list of credentials. The full scope of compromised subscriber data remains unverified.

What should defenders do?

Organizations should restrict internet-facing exposure of management and monitoring tools like MeshCentral, enforce strict access controls, and implement monitoring for unauthorized use of legitimate administrative software. Network segmentation and logging of tool usage are recommended to detect similar persistence mechanisms.

highCyber Attacks

3BB Broadband Provider Compromised via MeshCentral Backdoor for Root Access

Threat intelligence firm Hunt.io reports attacker used legitimate management tool to maintain persistent remote control and target subscriber credentials.

CyberIntel DeskPublished 15 days agoUpdated less than a minute ago1 min read

3BB Broadband Provider Compromised via MeshCentral Backdoor for Root Access

Key Takeaways

Attacker used MeshCentral, a legitimate management tool, as a backdoor for persistent remote control within the 3BB network.
The intrusion was discovered accidentally when the attacker left a server exposed on the internet, revealing their tools and a list of credentials.
The full scope of compromised subscriber credentials and the duration of the attacker's activity remain unconfirmed.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read