3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials

As cited

Copy frozen at 2026-09-14 20:02 UTC (site build).

threat intel

3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials

Threat intelligence firm Hunt.io identified an attacker maintaining persistent access within 3BB, a major Thai broadband provider, through MeshCentral, a legitimate remote management tool. The intrusion was discovered after the attacker exposed a server containing their tools and credential lists on the public internet.

Why it matters: Internet service provider customers and administrators at 3BB face credential theft and network compromise; practitioners should review MeshCentral deployments for unauthorized access and assess whether internal systems are exposed to the internet.

Source published

2026-09-14 18:01 UTC

First seen by Cybersecurity Tracker

2026-09-14 19:33 UTC