3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
Overview
An attacker gained unauthorized access to the network of 3BB, a major broadband provider in Thailand, using a legitimate remote management tool called MeshCentral. This allowed the attacker to maintain control over internal machines and potentially harvest subscriber credentials. The breach was discovered by the cybersecurity firm Hunt.io, which found an exposed server containing the attacker’s tools and a list of compromised data. This incident raises concerns about the security of management tools and the potential for attackers to exploit legitimate software for malicious purposes. Users of 3BB and similar services should be vigilant about their account security and monitor for any suspicious activity.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: 3BB broadband network, MeshCentral management tool
- Action Required: Companies should review their use of remote management tools, ensure they are properly secured, and monitor for any unauthorized access to their networks.
- Timeline: Newly disclosed
Original Article Summary
An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said. The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker's own tools and a list of
Impact
3BB broadband network, MeshCentral management tool
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Companies should review their use of remote management tools, ensure they are properly secured, and monitor for any unauthorized access to their networks.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Exploit, Data Breach.