Loading story…
An attacker-controlled staging server at 92.63.180[.]133:8888 exposed artifacts from a suspected intrusion into Thailand's 3BB/Triple T Broadband and related Jasmine infrastructure. The operation allegedly exploited the critical FortiOS/FortiProxy SSL-VPN out-of-bounds write flaw CVE-2024-21762 against a FortiGate 60F appliance at mail.3bb.co[.]th:10443, with the server also configured to receive a FortiGate reverse shell. Recovered files included internal addresses, service-targeting data, organization-specific password lists, and an apparent Triple T Broadband OpenVPN profile containing a certificate and private key.
The operators reportedly conducted reconnaissance, credential harvesting, SSH password spraying, Linux privilege-escalation attempts, lateral-movement preparation, web-shell deployment, and anti-forensic cleanup. They deployed MeshCentral for persistent remote administration, enrolling compromised devices in a TH-3BB group configured to connect to www.ayuthayatech[.]com; the tooling also sought RADIUS databases and subscriber credentials. Evidence indicates parallel targeting of Jasmine systems, but the available artifacts do not identify the operators or establish how they obtained environment-specific credentials.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
The www.ayuthayatech[.]com domain, used as the apparent MeshCentral management endpoint, was moved behind Cloudflare nameservers.
Hunt.io first captured an exposed directory on 92.63.180[.]133:8888 hosted on infrastructure attributed to Bangmod Enterprise. It contained 298 intrusion-related files across 30 subdirectories.
The domain www.ayuthayatech[.]com, later configured as the MeshCentral management server for compromised systems, was registered.
CISA added CVE-2024-21762, a critical FortiOS/FortiProxy SSL-VPN out-of-bounds write flaw, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
The cleanup_target.sh script removed logs, web shells, exploitation files, and other intrusion traces while preserving MeshCentral access and a hidden SUID binary at /usr/local/bin/.rc.
Recovered Jasmine PHP session tokens and systems in the 110.164.131.x range suggested parallel activity against Jasmine infrastructure. The toolkit also contained a Triple T Broadband-related OpenVPN profile with an embedded client certificate for 110.164.129[.]67:443.
Credential-harvesting scripts searched compromised hosts for SSH keys, PHP configuration, database passwords, SNMP strings, and shell history. Separate scripts targeted radius_corp, radiusinfo, and job_radius databases for RADIUS-related authentication data, while password spraying targeted more than 55 internal hosts.
Attackers deployed or prepared MeshCentral agents configured in the TH-3BB device group to connect to www.ayuthayatech[.]com over port 443. A device inventory showed multiple connected endpoints, including agents operating with root privileges.
A Ghostcat exploit tool targeted the internal Pentaho/Tomcat AJP service at 10.11.152.4:8009, and the got63.txt artifact recorded root-level command execution on vm-BCSWILDFLY_M63. The toolkit also included PwnKit, Dirty COW, and hidden SUID-backdoor capabilities.
The toolkit targeted agent.3bb.co[.]th, a CodeIgniter sales-agent portal behind F5 BIG-IP, with session-forgery, brute-force, SQL injection, traversal, SSRF, and request-smuggling attempts. An authenticated response artifact indicated access to internal register_report functionality, while the associated F5 system was probed for known vulnerabilities.
Recovered network configuration showed tooling executed from internal address 10.11.152.63 with the triplet.co.th DNS search domain, indicating an already compromised internal 3BB system.
Recovered tooling indicates attackers used CVE-2024-21762 against the FortiGate 60F SSL-VPN service at mail.3bb.co[.]th:10443. The exploit used heap spraying, malformed chunked requests, and a ROP chain to launch a Node.js reverse shell to 92.63.180[.]133:9443.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcehunt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A dataset tied to the **FortiBleed** campaign exposed credentials associated with internet-facing Fortinet and FortiGate devices used for SSL-VPN remote access, affecting organizations in **194 countries**. Researchers reported that the collection grew from roughly **73,000** compromised devices to **86,644** firewalls and VPN gateways, and included VPN URLs, usernames, email addresses, and in many cases **plaintext passwords**. Italian authorities warned that the circulating dataset was specifically linked to exposed SSL-VPN credentials on internet-accessible Fortinet systems. Independent validation found that some leaked credentials were authentic and still worked on exposed devices, including systems running recent **FortiOS** versions. Investigators linked the database to active threat actors conducting large-scale scanning, compromising devices, intercepting traffic, and using stolen access to move into internal networks; some follow-on intrusions reportedly ended with ransomware-style encryption of hundreds of systems. Analysis also indicated that both default or built-in Fortinet accounts and organization-created accounts were present in the leak, pointing to weak credential hygiene and credential reuse as contributing factors, while the original intrusion vector remained unknown.
Aug 1, 2026
FBI and CISA warned that APT actors were actively scanning internet-facing Fortinet devices and exploiting multiple FortiOS vulnerabilities, including **`CVE-2018-13379`**, **`CVE-2020-12812`**, and **`CVE-2019-5591`**, to gain initial access and maintain a foothold for follow-on attacks. The agencies said the activity affected government, commercial, technology, and critical infrastructure organizations, with scanning observed on ports **4443**, **8443**, and **10443**. In one cited case, an APT group almost certainly exploited a FortiGate appliance to access a web server hosting a U.S. municipal government domain and likely created the username **`elie`** on the network. The campaign built on long-running exploitation of Fortinet SSL VPN weaknesses, especially the path traversal flaw **`CVE-2018-13379`**, which had already enabled the leak of credential-bearing session files from nearly **50,000** vulnerable devices worldwide. Those exposed **`sslvpn_websession`** files contained plaintext usernames and passwords, allowing attackers to reuse credentials even after patching. U.S. authorities said compromised access could support data exfiltration, ransomware-style encryption, and other post-exploitation activity, and highlighted indicators including FRP tunneling tools, unusual FTP traffic over port **443**, and a scheduled task named **`SynchronizeTimeZone`**.
Sep 3, 2026
Huntress reported a confirmed enterprise intrusion in which an attacker appears to have gained access through a compromised FortiGate SSL VPN account and then deployed publicly available **Nightmare-Eclipse** tooling on Windows systems. The activity included execution of **BlueHammer**, **RedSun**, and **UnDefend**—tools designed to abuse Windows Defender logic flaws for privilege escalation or defense disruption—alongside hands-on-keyboard reconnaissance and suspicious VPN logins tied to infrastructure geolocated to Russia, Singapore, and Switzerland. Huntress said the privilege-escalation attempts did not appear to succeed in the investigated case, but the tooling was used in a live environment rather than as isolated proof-of-concept testing. The attacker also deployed a Go-based reverse tunneling utility Huntress tracks as **BeigeBurrow**, which established outbound connectivity over port 443 to `staybud.dpdns[.]org`, helping maintain access after the VPN intrusion. Huntress observed suspicious binaries staged in low-privilege, user-writable directories and warned defenders to treat any execution of these tools as urgent incident activity. Microsoft patched **BlueHammer** in April 2026 as `CVE-2026-33825`, while **RedSun** and **UnDefend** remained unpatched at the time of reporting, underscoring the risk from publicly released exploit tooling being operationalized in real-world attacks.
Jun 29, 2026